Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py parsed <$skillId|label> skill mentions with overlapping quantifiers, allowing an authenticated chat message containing <$ without a closing > to trigger quadratic backtracking and block the asyncio event loop. This issue is fixed in version 0.10.0.

Affected: PyPI: open-webui

## Summary Two regexes in `backend/open_webui/utils/middleware.py` that parse `<$skillId|label>` skill-mention tags backtrack in O(n²) on input that contains `<$` followed by a long run with no closing `>`. Both run synchronously, on the asyncio event loop, on **every** chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such input pins a CPU core inside `re` and freezes the entire instance for all users until the worker is killed. Any authenticated user can trigger it with one chat message; it also fires accidentally on benign retrieved content (a RAG chunk or tool output) containing the pattern.

## Affected versions `>= 0.9.2, < 0.10.0`. Fixed in **v0.10.0** (there is no 0.9.7 release). - `SKILL_MENTION_RE` (the extract pattern) has been O(n²) since **v0.9.2**; exploitable on 0.9.2–0.9.5 with a large input (hundreds of KB). - **v0.9.6** added a second, far more aggressive O(n²) in the strip pattern (introduced by the "keep label as readable text" change), so on 0.9.6 a small input is enough to hang the instance.

Both are fixed by the same patch.

## Affected component `backend/open_webui/utils/middleware.py` (line numbers as of v0.9.6):

```python # line 2223 — used by extract_skill_ids_from_messages(), called unconditionally (~line 2625) SKILL_MENTION_RE = re.compile(r'<\$([^|>]+)\|?[^>]*>')

# line 2247 — used by strip_skill_mentions(), called unconditionally (line 2662) strip_re = re.compile(r'<\$[^|>]+\|?([^>]*)>') ```…

Affected: PyPI: open-webui

## Summary Two regexes in `backend/open_webui/utils/middleware.py` that parse `<$skillId|label>` skill-mention tags backtrack in O(n²) on input that contains `<$` followed by a long run with no closing `>`. Both run synchronously, on the asyncio event loop, on **every** chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such input pins a CPU core inside `re` and freezes the entire instance for all users until the worker is killed. Any authenticated user can trigger it with one chat message; it also fires accidentally on benign retrieved content (a RAG chunk or tool output) containing the pattern.

## Affected versions `>= 0.9.2, < 0.10.0`. Fixed in **v0.10.0** (there is no 0.9.7 release). - `SKILL_MENTION_RE` (the extract pattern) has been O(n²) since **v0.9.2**; exploitable on 0.9.2–0.9.5 with a large input (hundreds of KB). - **v0.9.6** added a second, far more aggressive O(n²) in the strip pattern (introduced by the "keep label as readable text" change), so on 0.9.6 a small input is enough to hang the instance.

Both are fixed by the same patch.

## Affected component `backend/open_webui/utils/middleware.py` (line numbers as of v0.9.6):

```python # line 2223 — used by extract_skill_ids_from_messages(), called unconditionally (~line 2625) SKILL_MENTION_RE = re.compile(r'<\$([^|>]+)\|?[^>]*>')

# line 2247 — used by strip_skill_mentions(), called unconditionally (line 2662) strip_re = re.compile(r'<\$[^|>]+\|?([^>]*)>') ```…