Executive brief
PraisonAI is an AI framework that includes a recipe registry server for managing and sharing AI recipes. The WSGI-based registry server fails to enforce limits on uploaded file sizes, allowing any local user to send arbitrarily large requests that consume all available system memory, crashing the server and disrupting operations. By default, the server requires no authentication, making it accessible to any local process or application on the same host.
Technical details
The vulnerability exists in the WSGI recipe registry server (server.py) which reads the entire HTTP request body into memory based on the client-supplied Content-Length header without enforcing any maximum size limit. The root cause is the absence of request size validation at lines 551-555, where the body is read directly into memory. Additionally, multipart parsing creates secondary in-memory copies without size constraints. The attack vector is network-local; any process on the same host (including via SSRF from other services) can send large POST requests to exhaust memory since authentication is disabled by default (self.token defaults to None). An attacker can craft a 500MB+ upload request that causes out-of-memory errors, crashing the registry server process. The Starlette-based alternative server (serve.py) includes RequestSizeLimitMiddleware with a 10MB default, but the WSGI server has no equivalent. Patches are available in version 4.5.128 and later.
Affected products
- PraisonAI PraisonAI <=4.5.124
Timeline
- 2026-04-09: disclosed: Vulnerability published via GHSA-2xgv-5cv2-47vv
- 2026-04-10: patched: Fix available in version 4.5.128 and later