Executive brief
Wisp is a web framework for the Gleam programming language. A vulnerability in how it handles file uploads and form data allows an attacker to bypass security limits on request sizes. By sending a specially crafted, massive request, an attacker can crash the server by exhausting its memory or filling up its disk space, leading to a total service outage.
Technical details
A vulnerability exists in the multipart form body and header parsing logic within Wisp. The 'multipart_body' and 'multipart_headers' functions fail to decrement the remaining quota when processing data chunks that do not contain a multipart boundary (the 'MoreRequiredForBody' and 'MoreRequiredForHeaders' paths). Consequently, the 'max_body_size' and 'max_files_size' limits are only enforced on the final chunk containing the boundary. An unauthenticated remote attacker can exploit this by sending an arbitrarily large multipart request split across many chunks, leading to memory exhaustion (for form fields) or disk exhaustion (for file uploads). The issue is fixed in version 2.2.2.
Affected products
- gleam-wisp wisp 0.2.0 to 2.2.1
Timeline
- 2026-04-01: advisory: Vendor advisory published on GitHub
- 2026-04-02: disclosed: CVE published to NVD
- 2026-04-02: patched: Fix released in version 2.2.2