CVE-2026-32145: wisp Multipart Form Body Parser Bypass Leading to Denial of Service
Summary
CVE-2026-32145: Multipart form body parser bypasses body size limits in wisp. Affects wisp across 2 version ranges.
>= 0.2.0, < 2.2.2
>= d8e722e22ccb42bda9d0b6248658d37ab4e9b376, < 7a978748e12ab29db232c222254465890e1a4a90
Fixed in 2.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wisp is a web framework for building applications in the Gleam programming language. It is designed to facilitate the development of web applications by providing essential features such as routing, middleware support, and request handling. However, the framework has a vulnerability that allows attackers to bypass body size limits during multipart form submissions, potentially leading to resource exhaustion.
Vulnerability Detail
The vulnerability arises from the multipart_body function in wisp, which fails to enforce the configured max_body_size and max_files_size limits. When a multipart boundary is absent in a chunk, the parser appends the chunk to the output without decrementing the quota for the recursive call. This flaw allows an unauthenticated attacker to send excessively large multipart form submissions in a single HTTP request, resulting in denial of service by exhausting server memory or disk space.
How To Fix
Minimum fixed version
2.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a middleware that checks the size of incoming requests and rejects those that exceed a specified limit. For example:
defmodule MyApp.RequestSizeLimit do
import Plug.Conn
@max_size 5_000_000 # 5 MB
def init(default), do: default
def call(conn, _opts) do
if conn.req_body_length > @max_size do
conn
|> send_resp(413, "Request Entity Too Large")
|> halt()
else
conn
end
end
end
You can then add this middleware to your endpoint.
Conclusion
CVE-2026-32145 is a significant vulnerability in the wisp web framework that can lead to denial of service through multipart form submissions. It is crucial for developers using affected versions to update to the patched version 2.2.2 or later to mitigate this risk. Implementing temporary workarounds can also help protect applications until updates are applied.
See every vulnerability recorded for wisp →
FAQ
CVE-2026-32145 is a vulnerability in the wisp web framework that allows attackers to bypass multipart form body size limits, potentially leading to denial of service.
Any application using wisp versions from 0.2.0 to 2.2.1 is affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
If you cannot update the package, implement a middleware to limit request sizes as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for wisp.
