Elysia EUVD-2026-42394

Exploitation requires the target Elysia application (version < 1.4.29) to expose at least one endpoint that parses multipart/form-data request bodies; the attacker then sends such a request containing a large number of unique key-value pairs to trigger the O(n²) normalization. No authentication, no user interaction, and no non-default runtime configuration are needed (PR:N/UI:N/AC:L), so any reachable multipart endpoint is exploitable. The main limiting factor is deployment-specific: applications that never define multipart/form-data handlers are not affected, and upstream body-size or field-count limits (e.g., at a proxy) reduce the achievable impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: network-reachable, low-complexity, no authentication or user interaction, and impact limited to availability only. This is a genuine, easily-triggered remote DoS against any deployment exposing multipart/form-data endpoints, so it warrants prompt patching, but it is confined to availability - there is no confidentiality or integrity impact. Note a data conflict: the vendor tag labels this 'Information Disclosure,' which contradicts both the description (CPU exhaustion) and the CVSS vector (C:N/I:N/A:H) - the tag appears mislabeled and should be treated as a denial-of-service issue. No KEV listing and no EPSS score were provided, so real-world exploitation pressure cannot be quantified; the standalone availability impact and lack of any exploitation evidence make this a moderate operational priority rather than an emergency, though its trivial exploitation conditions argue against deferring the upgrade.

An attacker identifies an Elysia application (below 1.4.29) exposing an endpoint that accepts multipart/form-data and sends a single request packed with a large number of unique field names. The quadratic normalization pins a CPU core and blocks the event loop, and repeating the request keeps the service unresponsive to legitimate users. A public write-up (jviide gist) demonstrates the quadratic timing, effectively serving as proof of concept.