A flaw in wisp’s multipart form body parser lets an attacker bypass configured size limits, allowing arbitrarily large submissions. The parser does not enforce the max_body_size or max_files_size until the final boundary, meaning chunks of data can be stored without decrementing the allocated quota. An unauthenticated attacker can exploit this to consume server memory or disk, resulting in a denial of service.

The vulnerability impacts all releases of the wisp web server from version 0.2.0 up to, but not including, 2.2.2. It is specific to the gleam-wisp product.

The CVSS score of 8.7 indicates a high severity, while the lack of an EPSS score means current exploitation probability is unknown. The CVE is not listed in the CISA KEV catalog. Exploitation requires sending a crafted multipart/form‑data HTTP request; no authentication is required, making it readily exploitable by anyone on the network or the internet if the service is exposed.