EUVD-2026-93498
GHSA-2g7p-5934-q4w7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable malformed multipart request with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion (A:H), with no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
AnalysisAI
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-canary.33 trigger a ReDoS-style catastrophic backtracking path in multipart Content-Type validation, causing the parser to consume CPU/resources for an extremely long time and effectively hanging the affected endpoint. The flaw is reachable by remote attackers without authentication (CVSS 4.0 vector PR:N/UI:N, AV:N, VA:H), but exposure is limited to deployments that parse multipart bodies - i.e., upload-enabled collections or any route invoking Payload's Busboy-based request processing - and instances that place those endpoints behind access controls or that lack upload collections substantially reduce their attack surface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to expose a Payload endpoint that parses multipart request bodies - i.e., upload-enabled collections or any route invoking Payload's multipart/Busboy-based Content-Type processing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-400 uncontrolled resource consumption (ReDoS) flaw in Payload CMS multipart Content-Type validation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the payload npm package to 3.90.0 or later (stable 3.x line) or to 4.0.0-canary.34 or later (4.x canary line); the fix is delivered via commit https://github.com/payloadcms/payload/commit/0084bd51fb7742b26a88431bb84cb1696857e6dc and the 3.90.0 release, so this is a Vendor-released patch: 3.90.0 (and 4.0.0-canary.34). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Payload CMS instances and determine which ones run upload-enabled collections or any route that invokes Payload's Busboy-based multipart parsing, since those are the only materially exposed deployments; prioritize internet-facing instances and place rate limiting or a WAF rule in front of multipart endpoints as an immediate stopgap, and confirm logging is in place to detect requests that produce abnormally long processing times. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field c
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Stored Cross-Site Scripting (XSS) in Payload CMS versions prior to 3.78.0 allows authenticated users with write permissi
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today