CVE-2026-90991: 
Homebrew vulnerability analysis and mitigation

CVE-2026-90991 is a denial-of-service vulnerability in IBM Langflow OSS caused by allocation of resources without limits or throttling (CWE-770). It affects IBM Langflow OSS versions 1.0.0 through 1.12.4, and was published on October 29, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, IBM Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the application fails to impose restrictions on the size or number of resources that can be allocated on behalf of an authenticated user. An attacker with valid credentials can send crafted requests over the network that trigger unbounded resource allocation — such as memory, CPU, or storage — without any throttling or quota enforcement. No specific technical write-up or proof-of-concept code has been publicly disclosed at this time (GitHub Advisory, IBM Advisory).

Successful exploitation allows a remote authenticated attacker to exhaust system resources, causing the Langflow service to become unresponsive or crash entirely. The impact is limited to availability — there is no confidentiality or integrity impact. Depending on deployment architecture, a sustained attack could affect other services sharing the same infrastructure (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.383% (32nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and NVD SSVC assessment notes exploitation as "none" and the attack as non-automatable (GitHub Advisory).

IBM has released a patch addressing this vulnerability; users should upgrade IBM Langflow OSS to version 1.12.5 or later. As interim mitigations, administrators should implement rate limiting and resource quotas at both the application and infrastructure levels, restrict Langflow access to authenticated users with least-privilege controls, and monitor for anomalous resource consumption patterns. See the IBM support page and GitHub Advisory for patch details (IBM Advisory, GitHub Advisory).