CVE-2026-55446

Langflow: Unauthenticated DoS through multipart form boundary file upload

At a glance

Severity: HIGH 7.5
EPSS: EPSS 0.58 % · percentile 48 (2026-10-27)
State: PUBLISHED
Published: 2026-06-23
Updated: 2026-06-23
Assigner: GitHub_M
NVD status: Analyzed

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · security-advisories@github.com (Secondary)

Weaknesses (CWE)

CWE-400

Advisories

GHSA-qwqc-p3q8-wcg9 — Langflow: Unauthenticated DoS through multipart form boundary file upload
PYSEC-2026-223 — Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any

European references

ENISA EUVD · EUVD-2026-38515
GCVE · GCVE-0-2026-55446

Affected configurations (NVD CPE)

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* < 1.0.19

Affected products

Product	Versions
langflow-ai · langflow	affected < 1.0.19

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD