Mitigating PHP Multipart Parser Vulnerabilities

How to create web controls to place limits on multipart file uploads.

Vulnerabilities CVE-2026-109618, CVE-2026-109619 , and other related vulnerabilities caused by bugs in the PHP multipart form parser can be mitigated by using a “Sanitize Multipart Uploads” Web Control action. It works by intercepting, buffering, and validating multipart/form-data content before any part of it reaches application servers, mitigating size, content, and timing based attacks.

  1. Create a web control with a condition that will cover all PHP upload requests.

  2. To that web control, add a “Sanitize Multipart Uploads” web control action. Configure it with a maximum number of parts, maximum header size, and maximum content size for your application.

  3. If there are different parts of your application that have different values for these limits, create additional web controls with their own conditions to use different limits for each area.

Have questions not answered here? Contact Support to get more help.

Last modified on October 21, 2026