CVE-2026-40115: PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

CVE-2026-40115 · Severity: medium · CVSS 6.2 · Published 2026-04-09

PraisonAI is an AI framework that includes a recipe registry server for managing and sharing AI recipes. The WSGI-based registry server fails to enforce limits on uploaded file sizes, allowing any local user to send arbitrarily large requests that consume all available system memory, crashing the server and disrupting operations. By default, the server requires no authentication, making it accessible to any local process or application on the same host.

Technologies: Praisonai, praisonai (PyPI). Vendors: Praison, PyPI.

Quick answers

Is CVE-2026-40115 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40115 being exploited in the wild.
How severe is CVE-2026-40115?
Medium severity, with a CVSS score of 6.2, published 9 April 2026.
Which products and versions are affected?
praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.
Is there a fix for CVE-2026-40115?
Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40115 attacked?
It is attacked with local access.
Am I affected by CVE-2026-40115?
Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.5.128 or later
    pip install "praisonai>=4.5.128"

Technical details

The vulnerability exists in the WSGI recipe registry server (server.py) which reads the entire HTTP request body into memory based on the client-supplied Content-Length header without enforcing any maximum size limit. The root cause is the absence of request size validation at lines 551-555, where the body is read directly into memory. Additionally, multipart parsing creates secondary in-memory copies without size constraints. The attack vector is network-local; any process on the same host (including via SSRF from other services) can send large POST requests to exhaust memory since authentication is disabled by default (self.token defaults to None). An attacker can craft a 500MB+ upload request that causes out-of-memory errors, crashing the registry server process. The Starlette-based alternative server (serve.py) includes RequestSizeLimitMiddleware with a 10MB default, but the WSGI server has no equivalent. Patches are available in version 4.5.128 and later.

Affected products

  • PraisonAI PraisonAI <=4.5.124

Identifiers

  • CVE-2026-40115
  • GHSA-2xgv-5cv2-47vv
  • PYSEC-2026-2896

Timeline

  • 2026-04-09: disclosed: Vulnerability published via GHSA-2xgv-5cv2-47vv
  • 2026-04-10: patched: Fix available in version 4.5.128 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.