CVE-2026-94440

Summary

A memory exhaustion vulnerability in multipart form parsing allows attackers to bypass memory limits and read arbitrarily long lines into memory when remaining limit is less than 400 bytes, potentially leading to denial of service.

Exploitability

Exploitation requires sending a specially crafted multipart form request with a part that has less than 400 bytes remaining in its limit, making it moderately difficult to exploit without specific application configuration or access patterns.

Blast radius

The vulnerability could affect any web application processing multipart forms, potentially causing widespread denial of service across affected services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.590 or later to address the memory limit bypass in multipart form parsing.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.