CVE-2026-56669, with a CVSS score of 7.5, is a vulnerability in the form data normalization code due to inefficient algorithmic complexity, resulting in CPU exhaustion and potential denial-of-service attacks via endpoints using multipart/form-data. This flaw type, CWE-407, affects all versions prior to 1.4.29, allowing an attacker with normal user privileges to exploit it without requiring user interaction or exploiting sensitive data, ultimately leading to high-impact availability loss. The vulnerability occurs when Elysia's form data normalization code retrieves values from FormData using the getAll method, which grows quadratically in terms of work as the number of key-value pairs increases, causing CPU exhaustion and potential denial-of-service attacks.
We recommend you to update elysia to version 1.4.29.[/subscribe_to_unlock_form]
CVE-2026-56669, with a CVSS score of 7.5, is a vulnerability in the form data normalization code due to inefficient algorithmic complexity, resulting in CPU exhaustion and potential denial-of-service attacks via endpoints using multipart/form-data. This flaw type, CWE-407, affects all versions prior to 1.4.29, allowing an attacker with normal user privileges to exploit it without requiring user interaction or exploiting sensitive data, ultimately leading to high-impact availability loss. The vulnerability occurs when Elysia's form data normalization code retrieves values from FormData using the getAll method, which grows quadratically in terms of work as the number of key-value pairs increases, causing CPU exhaustion and potential denial-of-service attacks.
We recommend you to update elysia to version 1.4.29.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]