Is CVE-2026-55446 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55446 being exploited in the wild.

How severe is CVE-2026-55446?

High severity, with a CVSS score of 7.5, published 23 June 2026.

Which products and versions are affected?

langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.0.19.

Is there a fix for CVE-2026-55446?

Yes. langflow (PyPI): upgrade to 1.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55446 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55446?

Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55446: Langflow unauthenticated denial of service in file upload

CVE-2026-55446 · Severity: high · CVSS 7.5 · Published 2026-06-23

Langflow, a tool for building AI workflows, is vulnerable to a denial-of-service attack that can take the entire application offline. An attacker can send a specially crafted file upload request that forces the server to consume excessive resources, making it unresponsive to all users. This attack does not require a password or any special access, potentially leading to indefinite service outages.

Technologies: langflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55446 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55446 being exploited in the wild.
How severe is CVE-2026-55446?: High severity, with a CVSS score of 7.5, published 23 June 2026.
Which products and versions are affected?: langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.0.19.
Is there a fix for CVE-2026-55446?: Yes. langflow (PyPI): upgrade to 1.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55446 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55446?: Check whether you run langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

langflow (PyPI): upgrade to 1.0.19 or later
```
pip install "langflow>=1.0.19"
```

Technical details

A vulnerability in Langflow's file upload endpoint (/api/v1/files/upload/) allows for unauthenticated denial-of-service via uncontrolled resource consumption (CWE-400). The application fails to validate the multipart form boundary before processing, allowing an attacker to submit a payload containing an extremely large number of hyphens (e.g., 1,000,000+) following the boundary. This causes the server to enter a 'busy' state indefinitely while attempting to parse the malformed data. Additionally, the endpoint lacked authentication checks, allowing remote, unauthenticated attackers to trigger the flaw. Version 1.0.19 fixes this by implementing a 'check_boundary' middleware to validate boundary length and format, and by enforcing authentication and flow-ownership checks.

Affected products

langflow-ai Langflow < 1.0.19

Identifiers

CVE-2026-55446
GHSA-qwqc-p3q8-wcg9
PYSEC-2026-223

Timeline

2024-09-30: patched: Fix merged in pull request #3923
2026-06-19: advisory: GitHub Security Advisory published
2026-06-23: disclosed: CVE-2026-55446 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.