← Back to CVE Explorer

CVE-2026-32145

Full vulnerability record from the local CVENow database.

Description

Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing. The multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequiredForBody path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via decrement_quota. The same pattern exists in multipart_headers, where MoreRequiredForHeaders recurses without calling decrement_body_quota. An unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request. This issue affects wisp: from 0.2.0 before 2.2.2.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Analyzed
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-04-02 11:16:21.870000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON 
{
  "id": "CVE-2026-32145",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-04-02T11:16:21.870",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing.\n\nThe multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequiredForBody path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via decrement_quota. The same pattern exists in multipart_headers, where MoreRequiredForHeaders recurses without calling decrement_body_quota.\n\nAn unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request.\n\nThis issue affects wisp: from 0.2.0 before 2.2.2."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de asignación de recursos sin límites ni limitación (throttling) en gleam-wisp wisp permite una denegación de servicio a través del análisis del cuerpo de formularios multipart.\n\nLa función multipart_body omite los límites configurados de max_body_size y max_files_size. Cuando un límite multipart no está presente en un fragmento (chunk), el analizador toma la ruta MoreRequiredForBody, que añade el fragmento a la salida pero pasa la cuota sin cambios a la llamada recursiva. Solo el fragmento final que contiene el límite se cuenta a través de decrement_quota. El mismo patrón existe en multipart_headers, donde MoreRequiredForHeaders recurre sin llamar a decrement_body_quota.\n\nUn atacante no autenticado puede agotar la memoria o el disco del servidor enviando envíos de formularios multipart arbitrariamente grandes en una única solicitud HTTP.\n\nEste problema afecta a wisp: desde 0.2.0 antes de 2.2.2."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "gleam-wisp",
          "product": "wisp",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "wisp",
          "cpes": [
            "cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "wisp"
          ],
          "programFiles": [
            "src/wisp.gleam"
          ],
          "programRoutines": [
            {
              "name": "wisp:multipart_body/7"
            },
            {
              "name": "wisp:multipart_headers/5"
            }
          ],
          "repo": "https://github.com/gleam-wisp/wisp",
          "packageURL": "pkg:hex/wisp",
          "versions": [
            {
              "version": "0.2.0",
              "lessThan": "2.2.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "gleam-wisp",
          "product": "wisp",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "gleam-wisp/wisp",
          "cpes": [
            "cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "wisp"
          ],
          "programFiles": [
            "src/wisp.gleam"
          ],
          "programRoutines": [
            {
              "name": "wisp:multipart_body/7"
            },
            {
              "name": "wisp:multipart_headers/5"
            }
          ],
          "repo": "https://github.com/gleam-wisp/wisp.git",
          "packageURL": "pkg:github/gleam-wisp/wisp",
          "versions": [
            {
              "version": "d8e722e22ccb42bda9d0b6248658d37ab4e9b376",
              "lessThan": "7a978748e12ab29db232c222254465890e1a4a90",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T13:29:06.824466Z",
          "id": "CVE-2026-32145",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.2.0",
              "versionEndExcluding": "2.2.2",
              "matchCriteriaId": "3B524416-95F2-454D-B2EA-8F725A3CD624"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-32145.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/gleam-wisp/wisp/commit/7a978748e12ab29db232c222254465890e1a4a90",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/gleam-wisp/wisp/security/advisories/GHSA-8645-p2v4-73r2",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32145",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}