PraisonAI versions before 4.5.128 have a resource exhaustion vulnerability (CWE-770) in the WSGI-based recipe registry server (server.py). The server reads the entire HTTP request body into memory according to the Content-Length header without imposing an upper bound. Since authentication is disabled by default, local processes can send very large POST requests to consume excessive memory, resulting in denial of service. The Starlette-based server (serve.py) mitigates this with a 10MB request size limit, but the WSGI server does not have equivalent throttling. The vulnerability is addressed in PraisonAI version 4.5.128.

An unauthenticated local attacker can cause denial of service by exhausting server memory through sending arbitrarily large POST requests to the vulnerable WSGI-based server component. There is no impact on confidentiality or integrity reported. The vulnerability affects availability by causing server resource exhaustion.

Upgrade PraisonAI to version 4.5.128 or later, where this vulnerability is fixed by adding request size limits to the WSGI server. Until upgraded, restrict local access to the vulnerable server component to prevent exploitation. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 4.5.128.