Executive brief
Langflow is a platform for building and deploying AI-powered workflows. A flaw in its HTTP POST request handler allows an attacker with authenticated access to cause a regular expression to consume excessive CPU resources by providing specially crafted input, potentially leading to service disruption and denial of service.
Technical details
The vulnerability exists in the HTTP POST Request Handler component (src/backend/base/langflow/interface/utils.py) and is classified as an inefficient regular expression complexity issue (CWE-1333, also known as ReDoS—Regular Expression Denial of Service). The flaw is triggered through manipulation of the remaining_text argument passed to a regex function. An authenticated attacker can craft malicious input that causes the regex engine to perform exponential backtracking, consuming significant CPU resources and degrading service availability. The vulnerability affects Langflow versions up to and including 1.0.18. No vendor patch information has been disclosed.
Affected products
- Langflow Langflow up to 1.0.18
Timeline
- 2024-09-27: disclosed
- 2024-10-01: advisory