[GHSA] GHSA-jqhh-cjmq-vmv6 (medium) — Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

GHSA-jqhh-cjmq-vmv6 Severity: medium CVE: CVE-2026-88002

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

## Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own `id` field while moving through the history by map key, so a message that simply omitted `id