CVE-2024-7036
| CVE ID | CVE-2024-7036 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | High (CVSS 7.5, CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
Timeline
Open WebUI rejects this record as not a vulnerability; the assessment below is the project's official position. The issuing CNA has not responded and has not acted on the record, so the dispute has been escalated to the CVE Program Root.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
As of 2026-08-08, the record is still in the PUBLISHED state on cve.org and the dispute is before the CVE Program Root. This disposition stands as Open WebUI's official assessment.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, an unauthenticated attacker is claimed to be able to sign up with excessively large text in the name field, causing the admin panel to become unresponsive. The record classifies this as CWE-400 (Uncontrolled Resource Consumption) and scores it CVSS 7.5 (High).
Why This Is Not a Vulnerability
The name field is stored verbatim as a string. The server performs no amplifying work on it: it is written to the database and read back. There is no server-side resource-exhaustion primitive, and no server denial of service occurs.
There Is No Denial of Service
The name value is stored and served as an ordinary string, so nothing on the server is exhausted and no denial of service occurs. The report's claim that the admin panel becomes unresponsive does not describe any server-side condition: the server, its API, and every other user are unaffected. At most it refers to how a browser renders a very long value in a list, which is a characteristic of the browser and not a security weakness in Open WebUI.
Signup Is Governed by a Setting
Self-registration is gated by ENABLE_SIGNUP (ui.enable_signup). Once an instance has users, signup is reachable only when the administrator has enabled it, so the "unauthenticated" reach the report relies on is itself a configuration the administrator opts into.
CWE-400 Is Misapplied
Uncontrolled resource consumption requires unbounded server-side work. Storing a string is bounded work, and the observed slowdown is browser-side rendering of an oversized value, not server resource consumption.
Applicable Security Policy Rules
- Rule 1: Storing a string is bounded server-side work, the observed effect is client-side rendering rather than a server denial of service, and self-signup is governed by a configuration setting. No security boundary is crossed.
Impact to Users
No action required. The name field is stored as-is with no server-side amplification, and no denial of service occurs. How a browser renders a very long value is a front-end characteristic, not a security weakness, and self-registration is governed by the ENABLE_SIGNUP setting.