Skip to main content

IBM Langflow OSS CVE-2026-93679

| EUVDEUVD-2026-94118 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-10-07 ibm GHSA-j57w-mr47-g6cj
Denial Of Service IBM Langflow Oss
4.3
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
4.3 MEDIUM

Network-reachable extraction endpoint (AV:N/AC:L) requires authenticated low-privilege access to upload the ZIP (PR:L), causing only partial availability loss (A:L) with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Oct 07, 2026 - 00:51 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.

AnalysisAI

Authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can exhaust server resources by supplying a crafted ZIP archive to a code path that performs extraction, degrading or halting availability of the affected instance (CVSS 3.1 base 4.3, CWE-400). The flaw is reachable over the network by a low-privilege authenticated attacker (AV:N/PR:L/UI:N) and is limited to availability impact (C:N/I:N/A:L), with no data exposure, integrity loss, or code execution demonstrated. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to (1) hold valid low-privilege authenticated access to a Langflow OSS instance (PR:L), and (2) be able to supply a ZIP archive to a code path that performs extraction - the description ties the flaw specifically to uncontrolled resource consumption during ZIP file extraction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a low-to-moderate priority issue, not an urgent one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor fix referenced in IBM Support advisory node 7290694 (https://www.ibm.com/support/pages/node/7290694) - patch availability is confirmed by the vendor as available, but no specific patched version number is provided in the available data, so confirm the exact fixed release against the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Langflow Oss

View all
CVE-2026-9198 CRITICAL POC
9.8 Jul 17

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets any network-reachable attac
CVE-2026-19295 CRITICAL POC
9.9 Aug 28

Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitr
CVE-2026-7873 CRITICAL POC
9.9 Jun 30

Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-
CVE-2026-18729 HIGH POC
8.8 Aug 28

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with l
CVE-2026-9103 CRITICAL POC
9.8 Jul 17

Authentication bypass in IBM Langflow OSS 1.0.0 through 1.10.0 lets an unauthenticated remote attacker retrieve a long-l
CVE-2026-81204 CRITICAL
9.8 Sep 10

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an unauthenticated remote attacker to run
CVE-2026-79724 CRITICAL
9.8 Sep 10

Remote OS command execution in IBM Langflow OSS (versions 1.0.0 through 1.11.5) lets remote attackers run arbitrary oper
CVE-2026-10561 CRITICAL POC
10.0 Jun 22

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully comprom
CVE-2026-9135 CRITICAL
9.9 Jul 17

Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenti
CVE-2026-8476 CRITICAL
9.9 Jul 17

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a mali
CVE-2026-8481 CRITICAL
9.9 Jul 17

Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets any logged-in user run arbitrary Pytho
CVE-2026-8859 CRITICAL
9.9 Jul 17

Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plan

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-93679 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy