Denial of Service in PraisonAI Multi-Agent Teams System by Mervin Praison

CVE-2026-40115

What is CVE-2026-40115?

In the PraisonAI multi-agent teams system, prior to version 4.5.128, the WSGI-based recipe registry server (server.py) is susceptible to memory exhaustion due to the reading of the entire HTTP request body into memory. This process is linked to a client-supplied Content-Length header and occurs without an upper limit. Compounding this issue, authentication is disabled by default, allowing any local process to send excessively large POST requests, resulting in denial of service. Although the Starlette-based server (serve.py) mitigates this with a 10MB RequestSizeLimitMiddleware, the WSGI server lacks such protection. This vulnerability was addressed in version 4.5.128.

References