CVE-2026-32145

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32145", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-10T22:37:29.212Z", "datePublished": "2026-04-02T10:30:47.485Z", "dateUpdated": "2026-04-07T04:07:10.339Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["wisp"], "packageName": "wisp", "packageURL": "pkg:hex/wisp", "product": "wisp", "programFiles": ["src/wisp.gleam"], "programRoutines": [{"name": "wisp:multipart_body/7"}, {"name": "wisp:multipart_headers/5"}], "repo": "https://github.com/gleam-wisp/wisp", "vendor": "gleam-wisp", "versions": [{"lessThan": "2.2.2", "status": "affected", "version": "0.2.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["wisp"], "packageName": "gleam-wisp/wisp", "packageURL": "pkg:github/gleam-wisp/wisp", "product": "wisp", "programFiles": ["src/wisp.gleam"], "programRoutines": [{"name": "wisp:multipart_body/7"}, {"name": "wisp:multipart_headers/5"}], "repo": "https://github.com/gleam-wisp/wisp.git", "vendor": "gleam-wisp", "versions": [{"lessThan": "7a978748e12ab29db232c222254465890e1a4a90", "status": "affected", "version": "d8e722e22ccb42bda9d0b6248658d37ab4e9b376", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.2.2", "versionStartIncluding": "0.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "John Downey"}, {"lang": "en", "type": "remediation developer", "value": "Louis Pilfold"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing.<p>The <tt>multipart_body</tt> function bypasses configured <tt>max_body_size</tt> and <tt>max_files_size</tt> limits. When a multipart boundary is not present in a chunk, the parser takes the <tt>MoreRequiredForBody</tt> path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via <tt>decrement_quota</tt>. The same pattern exists in <tt>multipart_headers</tt>, where <tt>MoreRequiredForHeaders</tt> recurses without calling <tt>decrement_body_quota</tt>.</p><p>An unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request.</p><p>This issue affects wisp: from 0.2.0 before 2.2.2.</p>"}], "value": "Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing.\n\nThe multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequiredForBody path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via decrement_quota. The same pattern exists in multipart_headers, where MoreRequiredForHeaders recurses without calling decrement_body_quota.\n\nAn unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request.\n\nThis issue affects wisp: from 0.2.0 before 2.2.2."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-07T04:07:10.339Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/gleam-wisp/wisp/security/advisories/GHSA-8645-p2v4-73r2"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-32145.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32145"}, {"tags": ["patch"], "url": "https://github.com/gleam-wisp/wisp/commit/7a978748e12ab29db232c222254465890e1a4a90"}], "source": {"discovery": "EXTERNAL"}, "title": "Multipart form body parser bypasses body size limits in wisp", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Deploy a reverse proxy (such as nginx or HAProxy) in front of the wisp application and configure it to enforce request body size limits."}], "value": "Deploy a reverse proxy (such as nginx or HAProxy) in front of the wisp application and configure it to enforce request body size limits."}], "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T13:29:06.824466Z", "id": "CVE-2026-32145", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T19:47:22.060Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32145", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T13:29:06.824466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:29:12.423Z"}}], "cna": {"title": "Multipart form body parser bypasses body size limits in wisp", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "John Downey"}, {"lang": "en", "type": "remediation developer", "value": "Louis Pilfold"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/gleam-wisp/wisp", "vendor": "gleam-wisp", "modules": ["wisp"], "product": "wisp", "versions": [{"status": "affected", "version": "0.2.0", "lessThan": "2.2.2", "versionType": "semver"}], "packageURL": "pkg:hex/wisp", "packageName": "wisp", "programFiles": ["src/wisp.gleam"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "wisp:multipart_body/7"}, {"name": "wisp:multipart_headers/5"}]}, {"cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/gleam-wisp/wisp.git", "vendor": "gleam-wisp", "modules": ["wisp"], "product": "wisp", "versions": [{"status": "affected", "version": "d8e722e22ccb42bda9d0b6248658d37ab4e9b376", "lessThan": "7a978748e12ab29db232c222254465890e1a4a90", "versionType": "git"}], "packageURL": "pkg:github/gleam-wisp/wisp", "packageName": "gleam-wisp/wisp", "programFiles": ["src/wisp.gleam"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "wisp:multipart_body/7"}, {"name": "wisp:multipart_headers/5"}]}], "references": [{"url": "https://github.com/gleam-wisp/wisp/security/advisories/GHSA-8645-p2v4-73r2", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-32145.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32145", "tags": ["related"]}, {"url": "https://github.com/gleam-wisp/wisp/commit/7a978748e12ab29db232c222254465890e1a4a90", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Deploy a reverse proxy (such as nginx or HAProxy) in front of the wisp application and configure it to enforce request body size limits.", "supportingMedia": [{"type": "text/html", "value": "Deploy a reverse proxy (such as nginx or HAProxy) in front of the wisp application and configure it to enforce request body size limits.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing.\n\nThe multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequiredForBody path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via decrement_quota. The same pattern exists in multipart_headers, where MoreRequiredForHeaders recurses without calling decrement_body_quota.\n\nAn unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request.\n\nThis issue affects wisp: from 0.2.0 before 2.2.2.", "supportingMedia": [{"type": "text/html", "value": "Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing.<p>The <tt>multipart_body</tt> function bypasses configured <tt>max_body_size</tt> and <tt>max_files_size</tt> limits. When a multipart boundary is not present in a chunk, the parser takes the <tt>MoreRequiredForBody</tt> path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via <tt>decrement_quota</tt>. The same pattern exists in <tt>multipart_headers</tt>, where <tt>MoreRequiredForHeaders</tt> recurses without calling <tt>decrement_body_quota</tt>.</p><p>An unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request.</p><p>This issue affects wisp: from 0.2.0 before 2.2.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.2.2", "versionStartIncluding": "0.2.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-07T04:07:10.339Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32145", "state": "PUBLISHED", "dateUpdated": "2026-04-07T04:07:10.339Z", "dateReserved": "2026-03-10T22:37:29.212Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-02T10:30:47.485Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["wisp"], "packageName": "wisp", "packageURL": "pkg:hex/wisp", "product": "wisp", "programFiles": ["src/wisp.gleam"], "programRoutines": [{"name": "wisp:multipart_body/7"}, {"name": "wisp:multipart_headers/5"}], "repo": "https://github.com/gleam-wisp/wisp", "vendor": "gleam-wisp", "versions": [{"lessThan": "2.2.2", "status": "affected", "version": "0.2.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["wisp"], "packageName": "gleam-wisp/wisp", "packageURL": "pkg:github/gleam-wisp/wisp", "product": "wisp", "programFiles": ["src/wisp.gleam"], "programRoutines": [{"name": "wisp:multipart_body/7"}, {"name": "wisp:multipart_headers/5"}], "repo": "https://github.com/gleam-wisp/wisp.git", "vendor": "gleam-wisp", "versions": [{"lessThan": "7a978748e12ab29db232c222254465890e1a4a90", "status": "affected", "version": "d8e722e22ccb42bda9d0b6248658d37ab4e9b376", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B524416-95F2-454D-B2EA-8F725A3CD624", "versionEndExcluding": "2.2.2", "versionStartIncluding": "0.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing.\n\nThe multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequiredForBody path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via decrement_quota. The same pattern exists in multipart_headers, where MoreRequiredForHeaders recurses without calling decrement_body_quota.\n\nAn unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request.\n\nThis issue affects wisp: from 0.2.0 before 2.2.2."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni limitaci\u00f3n (throttling) en gleam-wisp wisp permite una denegaci\u00f3n de servicio a trav\u00e9s del an\u00e1lisis del cuerpo de formularios multipart.\n\nLa funci\u00f3n multipart_body omite los l\u00edmites configurados de max_body_size y max_files_size. Cuando un l\u00edmite multipart no est\u00e1 presente en un fragmento (chunk), el analizador toma la ruta MoreRequiredForBody, que a\u00f1ade el fragmento a la salida pero pasa la cuota sin cambios a la llamada recursiva. Solo el fragmento final que contiene el l\u00edmite se cuenta a trav\u00e9s de decrement_quota. El mismo patr\u00f3n existe en multipart_headers, donde MoreRequiredForHeaders recurre sin llamar a decrement_body_quota.\n\nUn atacante no autenticado puede agotar la memoria o el disco del servidor enviando env\u00edos de formularios multipart arbitrariamente grandes en una \u00fanica solicitud HTTP.\n\nEste problema afecta a wisp: desde 0.2.0 antes de 2.2.2."}], "id": "CVE-2026-32145", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32145", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T13:29:06.824466Z", "version": "2.0.3"}}]}, "published": "2026-04-02T11:16:21.870", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch", "Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-32145.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/gleam-wisp/wisp/commit/7a978748e12ab29db232c222254465890e1a4a90"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/gleam-wisp/wisp/security/advisories/GHSA-8645-p2v4-73r2"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32145"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.2.0,2.2.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:hex/wisp@0.2.0,pkg:hex/wisp@2.2.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8e722e22ccb42bda9d0b6248658d37ab4e9b376,7a978748e12ab29db232c222254465890e1a4a90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:github/gleam-wisp/wisp@d8e722e22ccb42bda9d0b6248658d37ab4e9b376,pkg:github/gleam-wisp/wisp@7a978748e12ab29db232c222254465890e1a4a90)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wisp", "vendor": "gleam-wisp"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.2.0,2.2.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:hex/wisp@0.2.0,pkg:hex/wisp@2.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wisp", "source": "cna", "vendor": "gleam-wisp"}, "product": "wisp", "vendor": "gleam-wisp"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8e722e22ccb42bda9d0b6248658d37ab4e9b376,7a978748e12ab29db232c222254465890e1a4a90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:github/gleam-wisp/wisp@d8e722e22ccb42bda9d0b6248658d37ab4e9b376,pkg:github/gleam-wisp/wisp@7a978748e12ab29db232c222254465890e1a4a90)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wisp", "source": "cna", "vendor": "gleam-wisp"}, "product": "wisp", "vendor": "gleam-wisp"}], "analysis": {"en": {"generated_at": "2026-04-02T11:20:11.949571+00:00", "value": {"mitigation_remediation": ["Upgrade to wisp version 2.2.2 or later to resolve the parser flaw.", "If an upgrade is not immediately possible, place a reverse proxy such as nginx or HAProxy in front of the wisp application and configure it to enforce request body size limits.", "Monitor server memory and disk usage for sudden spikes that may indicate a denial\u2011of\u2011service attempt.", "Review access logs for unusually large multipart/form\u2011data entries and take further isolation steps if needed."], "summary": {"action": "Apply Patch", "impact": "Denial of Service via resource exhaustion"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts all releases of the wisp web server from version 0.2.0 up to, but not including, 2.2.2. It is specific to the gleam-wisp product.", "description_and_impact": "A flaw in wisp\u2019s multipart form body parser lets an attacker bypass configured size limits, allowing arbitrarily large submissions. The parser does not enforce the max_body_size or max_files_size until the final boundary, meaning chunks of data can be stored without decrementing the allocated quota. An unauthenticated attacker can exploit this to consume server memory or disk, resulting in a denial of service.", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity, while the lack of an EPSS score means current exploitation probability is unknown. The CVE is not listed in the CISA KEV catalog. Exploitation requires sending a crafted multipart/form\u2011data HTTP request; no authentication is required, making it readily exploitable by anyone on the network or the internet if the service is exposed."}}}}, "created": "2026-04-02T20:12:53.721179+00:00", "updated": "2026-04-02T20:21:33.207218+00:00", "vendors": ["gleam-wisp", "gleam-wisp$PRODUCT$wisp"]}