CVE-2026-88002

Open WebUI, a widely self-hosted AI platform, contains an infinite loop (CWE-835) in the message-chain reconstruction helper in backend/open_webui/utils/misc.py affecting versions 0.5.0 through 0.11.0. The bug arises because the traversal advances by map key but tracks visited entries by each message body's optional id field, so an authenticated user who stores messages without ids arranged in a parent cycle can trigger a non-terminating walk. This blocks the async event loop and grows memory until the process is killed, and because the crafted chat is persisted, the hang recurs after every restart — effectively a persistent denial of service of the entire instance from a single low-privileged account (CVSS 3.1: 6.5, availability impact only). The issue is fixed in version 0.11.1. No exploitation in the wild is known (EPSS 0.3%, not in CISA KEV), but the vendor's GitHub security advisory (GHSA-jqhh-cjmq-vmv6) publicly documents the flaw, and authentication is a low bar on instances with open registration.

What to do: Upgrade Open WebUI to version 0.11.1 or later immediately. If an instance has already been poisoned with an id-less parent-cycle chat, upgrading alone may not be enough — locate and remove the offending chat record from the database, since the hang persists across restarts. Operators should also verify whether open self-registration or weak credentials allow untrusted users to reach the authenticated message-handling code paths, and watch for single-process memory growth or unresponsive workers as an indicator of attempted triggering.