CVE-2026-32145 Details

A denial-of-service vulnerability has been identified in the Gleam Wisp web framework, specifically in versions 0.2.0 prior to 2.2.2. The issue arises in the multipart form body parsing, where the parser bypasses configured size limits for both the body and files. This flaw allows an unauthenticated attacker to send large multipart form submissions that exhaust server memory or disk space. The vulnerability is rooted in the parsing logic, which fails to properly account for data chunks that do not contain the multipart boundary, leading to uncontrolled resource consumption.

Users can upgrade to Wisp version 2.2.2, which addresses the vulnerability by ensuring that the multipart parser correctly enforces the maximum body size limits. Alternatively, a reverse proxy can be deployed in front of the application to enforce request body size limits, rejecting large multipart requests before they reach the vulnerable parser.