CVE-2026-55446CWE-400

Langflow: Unauthenticated DoS through multipart form boundary file upload

High · published June 23, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00581 · 47.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-06-23T16:26Z
EPSS history
Timeline
  • 23 JUN 16:26Z
    Langflow: Unauthenticated DoS through multipart form boundary file upload
    cvelistv5