CVE-2026-40115 Details

A denial-of-service vulnerability has been identified in the WSGI-based recipe registry server of PraisonAI, prior to version 4.5.128. The server reads the entire HTTP request body into memory based on the Content-Length header, without any upper limit. This issue is compounded by the fact that authentication is disabled by default, allowing any local process to send large POST requests that can exhaust server memory. While the Starlette-based server includes a request size limit, the WSGI server lacks such protection, leading to potential memory exhaustion and server crashes.

Users are advised to update to PraisonAI version 4.5.128 or later, where this vulnerability has been fixed. For those using the WSGI server, consider adding a request size limit to the application, similar to the 10MB default limit in the Starlette-based server. Additionally, be cautious when binding the server to '0.0.0.0', as this can expose the vulnerability to the network.