Comment by TekMol
9 hours ago
Why is the description of "RCE via OOM corruption" mentioning all these settings like memory_limit, post_max_size, max_input_nesting_level etc under "Mitigation" but not blocking multipart requests? Isn't that a solution?
The description of the vurnurability "Several multipart parsing problems" makes it sound like it is?
No, it’s not a solution, it’s only one example proof of concept on how to exploit the vulnerability, there are more.
I blocked multipart uploads in addition to adjusting post_max_size, etc
blog that was helpful to me: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...