IBM Langflow OSS EUVD-2026-32495

The description states only 'uncontrolled resource consumption' and names no specific feature, endpoint, protocol, configuration setting, or deployment mode, so the exact prerequisite trigger is not described in the available sources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires network reachability to the Langflow service but no authentication and no user interaction. The primary limiting factor is therefore exposure: the Langflow instance must be network-accessible to the attacker (e.g., an internet-facing or reachable internal deployment); instances bound to localhost or placed behind authenticated proxies or rate-limiting would reduce realistic exposure. Impact is availability-only - no data compromise.

Signals are consistent but point to moderate, not urgent, risk. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with availability-only impact - a classic uncontrolled-resource-consumption denial of service (CWE-400), no confidentiality or integrity loss. The exploitation-oriented signals temper this: EPSS is 0.04% (12th percentile), the vulnerability is NOT in CISA KEV, and SSVC records Exploitation: none, Automatable: no, Technical Impact: partial. These align rather than conflict - a high CVSS severity score driven entirely by the A:H component, but with no evidence of real-world exploitation and low predicted exploitation probability. The only reference is the IBM support/advisory page; there is no public exploit or PoC reference in the input. The vuln.today priority label is 'this_week', indicating it should be remediated on a routine near-term schedule rather than as an emergency. Net assessment: a legitimate availability risk for internet-exposed Langflow instances, but the absence of exploitation evidence and the availability-only, non-automatable profile place it below actively-exploited priorities. The specific trigger (which endpoint, input, or operation drives the resource consumption) is not described in the available sources, which limits precise exposure assessment.

A remote, unauthenticated attacker sends crafted or high-volume requests to a network-exposed IBM Langflow OSS instance (1.0.0 through 1.9.0) that cause uncontrolled consumption of a resource such as CPU, memory, or connections, degrading or halting service for legitimate users. The exact triggering input and resource are not described in the available sources. No public exploit or PoC reference is present in the input.