# CVE-2026-101040: Ricoh SP multipart parser infinite loop denial of service

Source: https://junglewise.ai/threats/cve-2026-101040-a-security-flaw-has-been-discovered-in-ricoh-sp-330dn-sp-221-sp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101040 · Severity: medium · CVSS 6.5 · Published 2026-09-28

Ricoh multifunction printers contain a flaw in their HTTP request handling that allows remote attackers to cause a denial of service by sending a specially crafted multipart request. When a malformed HTTP multipart form header is received, the printer's request processor gets stuck in an infinite loop and stops responding to legitimate requests. The vendor was notified but has not provided a fix.

Vendors: [Ricoh](https://junglewise.ai/threats/vendors/ricoh).

## Quick answers

**Is CVE-2026-101040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101040 being exploited in the wild.

**How severe is CVE-2026-101040?** Medium severity, with a CVSS score of 6.5, published 28 September 2026.

**Which products and versions are affected?** Ricoh Aficio SP 3500SF up to 20260813; Ricoh SP 221 up to 20260813; Ricoh SP 330DN up to firmware V1.11; Ricoh SP C252SF up to 20260813.

**Is there a fix for CVE-2026-101040?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101040 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-101040?** Check whether you run Ricoh Aficio SP 3500SF, Ricoh SP 221, Ricoh SP 330DN or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The HTTP multipart/form-data parser in affected Ricoh printer firmware contains an infinite loop vulnerability (CWE-835) where a missing line terminator in a multipart header causes the parser to re-enter the loop without advancing the input cursor. This occurs when the parser fails to find a newline character in the multipart header and continues processing the same bytes repeatedly. An unauthenticated remote attacker can exploit this via a crafted POST request to the HTTP handler, causing the affected HTTP request-processing task to hang and triggering a denial of service.

## Affected products

- Ricoh SP 330DN up to firmware V1.11
- Ricoh SP 221 up to 20260813
- Ricoh SP C252SF up to 20260813
- Ricoh Aficio SP 3500SF up to 20260813

## Timeline

- 2026-09-28: disclosed: Vulnerability disclosed publicly
- 2026-09-28: exploited: Public exploit (poc.py) released; not yet confirmed in wild

## References

- [https://github.com/xiaobor123/vuls-find-VxWorks/blob/main/RICOH/03-SP330DN-multipart-parser-infinite-loop/poc.py](https://github.com/xiaobor123/vuls-find-VxWorks/blob/main/RICOH/03-SP330DN-multipart-parser-infinite-loop/poc.py)
- [https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/RICOH/03-SP330DN-multipart-parser-infinite-loop](https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/RICOH/03-SP330DN-multipart-parser-infinite-loop)