Am I affected by Langflow: Unauthenticated DoS through multipart form boundary file upload? What should I do?
An attacker can send a
/api/v1/files/upload/request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time.Affected: langflow < 1.0.19. Fixed in: 1.0.19. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-55446-langflow (opens external site)
1 answer
Am I affected? Affected: langflow < 1.0.19. Fixed in: 1.0.19.
- Check your version: run
pip show langflow. Versions < 1.0.19 of langflow are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "langflow>=1.0.19"(first patched version 1.0.19). - Upgrade to 1.0.19 or later.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-qwqc-p3q8-wcg9 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-55446-langflow (opens external site)
Did this work for you?- Check your version: run