CVE-2026-32145: Wisp Multipart Quota Bypass

Multipart body chunks are being processed without decrementing the remaining size quota. This allows an attacker to bypass file and body size limits by omitting the boundary and sending continuous chunks, leading to resource exhaustion and Denial of Service (DoS). Ensure `decrement_quota` or `decrement_body_quota` is called on the read bytes before recursive

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Generic
greprules fetch cve-2026-32145-wisp-multipart-quota-bypass --engine opengrep

Description

Multipart body chunks are being processed without decrementing the remaining size quota. This allows an attacker to bypass file and body size limits by omitting the boundary and sending continuous chunks, leading to resource exhaustion and Denial of Service (DoS). Ensure `decrement_quota` or `decrement_body_quota` is called on the read bytes before recursive