{"data":{"id":"c7f9dfea-f348-4bd1-83d5-34646e736817","title":"GHSA-qwqc-p3q8-wcg9: Langflow: Unauthenticated DoS through multipart form boundary file upload","summary":"Langflow's `/api/v1/files/upload/` endpoint processes multipart form data before any authentication check, so an unauthenticated attacker can send a request with an oversized run of hyphens after the boundary and make the server unusable for all users indefinitely. The attacker does not need a valid flow ID, since the server parses the body even when the path ID is random, and the request can be repeated at will.","solution":"Fixed in 1.0.19 via PR #3923. A `check_boundary` HTTP middleware validates the multipart boundary against `^[\\w\\-]{1,70}$` and rejects malformed requests with HTTP 422 before the body is parsed, and the upload endpoint gained an authentication and flow-ownership check (`get_current_active_user`, HTTP 403 on mismatch). Upgrade to 1.0.19 or later.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-qwqc-p3q8-wcg9","publishedAt":"2026-06-19T21:17:37.000Z","cveId":"CVE-2026-55446","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["langflow@< 1.0.19 (fixed: 1.0.19)"],"affectedPackageNames":["langflow"],"affectedPackageRefs":["pypi:langflow"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00581,"epssCheckedAt":"2026-11-04T18:09:13.116Z","kevDateAdded":null,"advisoryAliases":["GHSA-qwqc-p3q8-wcg9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-19T21:17:37.000Z","fixReleasedAt":"2024-10-10T22:37:38.323Z","daysToFix":-617,"fixCheckedAt":"2026-10-29T21:34:08.514Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.0.19","matchedVersion":"1.0.19","fixReleasedAt":"2024-10-10T22:37:38.323Z","daysToFix":-617,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:34:08.369Z"}]}}