CVE-2026-55446: Langflow Denial of Service (DOS) Vulnerability

CVE-2026-55446 Overview

CVE-2026-55446 is a denial-of-service vulnerability in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. Versions prior to 1.0.19 expose the /api/v1/files/upload/ endpoint without authentication. An unauthenticated remote attacker can submit a request containing an excessively long multipart form boundary, causing the Langflow application to become unresponsive for all users for an indefinite period. The issue is tracked under [CWE-400] (Uncontrolled Resource Consumption) and is fixed in version 1.0.19.

Critical Impact

An unauthenticated attacker can render a Langflow instance unusable for all users with a single crafted HTTP request to the file upload endpoint.

Affected Products

• Langflow versions prior to 1.0.19
• Langflow /api/v1/files/upload/ endpoint
• Self-hosted Langflow deployments exposing the API over the network

Discovery Timeline

• 2026-06-23 - CVE-2026-55446 published to NVD
• 2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-55446

Vulnerability Analysis

The vulnerability resides in how Langflow's file upload handler parses incoming multipart form data. The /api/v1/files/upload/ endpoint accepts requests without requiring an authentication token or session cookie. This permits any network-reachable client to submit upload payloads directly to the application. The parser does not enforce an upper bound on the length of the multipart boundary string supplied in the Content-Type header. When an attacker provides a very large boundary value, the underlying parsing routine consumes excessive resources processing the request. The result is that the Langflow process becomes unresponsive to legitimate users for an extended duration. Refer to the GitHub Security Advisory GHSA-qwqc-p3q8-wcg9 for additional technical details.

Root Cause

Two design flaws combine to produce the vulnerability. First, the file upload endpoint lacks any authentication requirement, granting anonymous access to a resource-intensive code path. Second, the multipart parsing logic does not validate or constrain the length of the boundary delimiter before processing the form body. This maps to [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

The attack vector is fully network-based and requires no privileges or user interaction. An attacker sends a single HTTP POST request to /api/v1/files/upload/ with a Content-Type: multipart/form-data; boundary=<very-long-string> header. The application then attempts to parse the malformed request and ties up worker resources, blocking other users from interacting with the service. The fix in pull request langflow-ai/langflow#3923 constrains boundary handling and is shipped in version 1.0.19.

No public proof-of-concept code has been released for this issue. See the vendor advisory for further technical context.

Detection Methods for CVE-2026-55446

Indicators of Compromise

• Inbound HTTP POST requests to /api/v1/files/upload/ containing abnormally long boundary= values in the Content-Type header.
• Sudden unresponsiveness of the Langflow application coinciding with elevated CPU or memory utilization in the Langflow process.
• Repeated upload attempts from a single source IP without prior authenticated activity.

Detection Strategies

• Inspect web server and reverse proxy logs for multipart/form-data requests where the boundary token exceeds typical lengths (for example, more than 200 characters).
• Alert on HTTP requests to /api/v1/files/upload/ lacking valid authentication context.
• Correlate slow response times or request timeouts with upload endpoint activity.

Monitoring Recommendations

• Forward Langflow access logs and host telemetry to a centralized analytics platform for query and alerting.
• Track baseline request latency on /api/v1/files/upload/ and trigger alerts on sustained deviations.
• Monitor process-level CPU and memory usage of the Langflow service for anomalous spikes.

How to Mitigate CVE-2026-55446

Immediate Actions Required

• Upgrade Langflow to version 1.0.19 or later, which contains the official fix.
• Restrict network exposure of the Langflow API to trusted users via a VPN, firewall rules, or an authenticating reverse proxy.
• Audit access logs for prior exploitation attempts against /api/v1/files/upload/.

Patch Information

The vulnerability is resolved in Langflow 1.0.19. The corresponding fix is documented in GitHub Pull Request langflow-ai/langflow#3923 and the GitHub Security Advisory GHSA-qwqc-p3q8-wcg9. Operators should validate the running version after upgrade and confirm the upload endpoint behaves as expected.

Workarounds

• Place Langflow behind a reverse proxy (such as nginx or Envoy) that enforces a maximum Content-Type header length and request size.
• Require authentication at the proxy layer for all /api/v1/files/* routes until the upgrade is applied.
• Apply rate limiting on the upload endpoint to reduce the impact of repeated malformed requests.

# Example nginx mitigation: cap header sizes and require auth on upload routes
http {
    large_client_header_buffers 4 8k;
    client_header_buffer_size 8k;

    server {
        location /api/v1/files/upload/ {
            auth_request /_auth;
            client_max_body_size 25m;
            proxy_pass http://langflow_upstream;
        }
    }
}