AI Threat AlertCVE-2026-93679: Langflow: ZIP extraction resource exhaustion allows DoS
MEDIUMLangflow OSS 1.0.0 through 1.12.2 fails to limit resource use when extracting ZIP files, so any authenticated user can crash or degrade the service (a classic zip-bomb style denial of service, CWE-400). The practical risk is moderate to low: the CVSS is 4.3, impact is availability only (no confidentiality or integrity loss), EPSS is 0.47% (top 61%), it is not in CISA KEV, and there is no public exploit or Nuclei template. It still deserves attention if Langflow is shared across teams or exposed beyond a trusted network, because a low-privilege account is enough and Langflow has 194 other tracked CVEs, which signals a heavy patch burden. Upgrade to the fixed release listed in IBM's advisory (https://www.ibm.com/support/pages/node/7290694), which is above 1.12.2, and restrict upload/import endpoints and container resource limits until you do.
What is the risk?
Low-to-medium. Exploitation is easy (network, low complexity, low privileges, no user interaction) but impact is limited to availability. No KEV listing, no public exploit and low EPSS (0.00469) suggest opportunistic exploitation is unlikely in the near term. Risk rises for multi-tenant or internet-reachable Langflow instances where untrusted users hold accounts, and for instances hosting production agent or RAG workflows where downtime has business impact. The package's risk score of 77/100 and 194 other CVEs indicate a weak overall security posture.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Langflow to the patched version identified in the IBM advisory (newer than 1.12.2). 2) Until patched, restrict access to ZIP upload/import functionality, limit account provisioning and remove unused low-privilege accounts. 3) Run Langflow in containers with CPU, memory, ephemeral-storage and PID limits, and put extraction directories on a size-capped volume. 4) Enforce upload size limits at the reverse proxy or WAF. 5) Detect by alerting on abnormal disk growth in temp/extraction paths, sudden CPU or memory spikes, OOM kills and repeated archive uploads from a single account. 6) Keep Langflow off the public internet or behind SSO/VPN.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-93679?
Langflow OSS 1.0.0 through 1.12.2 fails to limit resource use when extracting ZIP files, so any authenticated user can crash or degrade the service (a classic zip-bomb style denial of service, CWE-400). The practical risk is moderate to low: the CVSS is 4.3, impact is availability only (no confidentiality or integrity loss), EPSS is 0.47% (top 61%), it is not in CISA KEV, and there is no public exploit or Nuclei template. It still deserves attention if Langflow is shared across teams or exposed beyond a trusted network, because a low-privilege account is enough and Langflow has 194 other tracked CVEs, which signals a heavy patch burden. Upgrade to the fixed release listed in IBM's advisory (https://www.ibm.com/support/pages/node/7290694), which is above 1.12.2, and restrict upload/import endpoints and container resource limits until you do.
Is CVE-2026-93679 actively exploited?
No confirmed active exploitation of CVE-2026-93679 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-93679?
1) Upgrade Langflow to the patched version identified in the IBM advisory (newer than 1.12.2). 2) Until patched, restrict access to ZIP upload/import functionality, limit account provisioning and remove unused low-privilege accounts. 3) Run Langflow in containers with CPU, memory, ephemeral-storage and PID limits, and put extraction directories on a size-capped volume. 4) Enforce upload size limits at the reverse proxy or WAF. 5) Detect by alerting on abnormal disk growth in temp/extraction paths, sudden CPU or memory spikes, OOM kills and repeated archive uploads from a single account. 6) Keep Langflow off the public internet or behind SSO/VPN.
What systems are affected by CVE-2026-93679?
This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Low-code AI application builders.
What is the CVSS score for CVE-2026-93679?
CVE-2026-93679 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.31%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.
Exploitation Scenario
An attacker with a low-privilege Langflow account (a compromised credential, a self-registered user, or a malicious insider) uploads or imports a specially crafted ZIP, such as a highly compressed archive with a huge expansion ratio or an enormous number of entries. Langflow extracts it without limiting size or file count, filling disk or exhausting memory and CPU. The service becomes unresponsive, interrupting AI agent workflows and API-served flows until an operator restarts the instance and cleans up the extracted data. The attacker can repeat the request after each restart.
Weaknesses (CWE)
CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.
- [Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- [Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow