EUVD-2026-21160
GHSA-2xgv-5cv2-47vv
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the WSGI-based recipe registry server (server.py) reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication being disabled by default (no token configured), any local process can send arbitrarily large POST requests to exhaust server memory and cause a denial of service. The Starlette-based server (serve.py) has RequestSizeLimitMiddleware with a 10MB limit, but the WSGI server lacks any equivalent protection. This vulnerability is fixed in 4.5.128.
AnalysisAI
Memory exhaustion denial of service in PraisonAI's WSGI-based recipe registry server (server.py) affects versions prior to 4.5.128. The vulnerability allows unauthenticated local processes to send arbitrarily large POST requests by spoofing the Content-Length header, causing the server to allocate unbounded memory and crash. Authentication is disabled by default, eliminating any access control barrier. The Starlette-based alternative server (serve.py) includes a 10MB request size limit, but the WSGI implementation lacks equivalent protection. Vendor-released patch: version 4.5.128 or later.
Technical ContextAI
PraisonAI implements two distinct HTTP server implementations: a WSGI-based recipe registry server (server.py) and a Starlette-based server (serve.py). The vulnerability resides in the WSGI server's request handling logic, which trusts the client-supplied Content-Length HTTP header as the authoritative size of the incoming request body and loads the entire body into memory without validation or limits. This violates the principle of not trusting client-supplied input for resource allocation decisions. The root cause is improper resource management (CWE-770: Allocation of Resources Without Limits or Throttling). The Starlette implementation demonstrates the correct pattern by implementing RequestSizeLimitMiddleware with a hardcoded 10MB ceiling, but this protection is absent in the WSGI server. Authentication is not enforced by default, meaning any process with network access to the WSGI server port can initiate the attack without credentials.
RemediationAI
Upgrade PraisonAI to version 4.5.128 or later, which implements request size limits in the WSGI server analogous to the RequestSizeLimitMiddleware present in the Starlette implementation. As a temporary workaround pending upgrade, disable or restrict network access to the WSGI recipe registry server (server.py) in production environments, or deploy network-level request size limits at the reverse proxy or firewall layer to reject POST requests exceeding a defined threshold (e.g., 10MB to match Starlette behavior). Enable authentication by configuring a token/API key, even as a temporary measure, to reduce the attack surface to authenticated clients only. Refer to the official GitHub Security Advisory (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2xgv-5cv2-47vv) for patch details and version confirmation.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today