Every CVE Search/ Get API key

CVE-2026-28356

ReDoS in multipart 1.3.0 - `parse_options_header()`

7.5 HighFix available

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.84%Up 0.3 points since Mar 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

ReDoS in multipart 1.3.0 - `parse_options_header()`

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
CVE-2026-28356
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-1333
Updated
2026-11-02
EUVDEUVD-2026-11607 7.5

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
EUVD-2026-11607
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-p2m9-wcp5-6qw3 7.5

multipart vulnerable to ReDoS in `parse_options_header()`

Summary

The parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams.

Impact

Any WSGI or ASGI application using multipart.parse_form_data() directly or indirectly (e.g. while parsing multipart/form-data streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.

Affected versions

All versions up to and including 1.3.0 are affected. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
GHSA-p2m9-wcp5-6qw3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
NVD 7.5

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
CVE-2026-28356
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSV 7.5

ReDoS in multipart 1.3.0 - `parse_options_header()`

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
CVE-2026-28356
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVDEBIAN-CVE-2026-28356 7.5

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
DEBIAN-CVE-2026-28356
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-p2m9-wcp5-6qw3 7.5

multipart vulnerable to ReDoS in `parse_options_header()`

Summary

The parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams.

Impact

Any WSGI or ASGI application using multipart.parse_form_data() directly or indirectly (e.g. while parsing multipart/form-data streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.

Affected versions

All versions up to and including 1.3.0 are affected. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
GHSA-p2m9-wcp5-6qw3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVPYSEC-2026-2670 7.5

multipart vulnerable to ReDoS in `parse_options_header()`

Summary

The parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams.

Impact

Any WSGI or ASGI application using multipart.parse_form_data() directly or indirectly (e.g. while parsing multipart/form-data streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.

Affected versions

All versions up to and including 1.3.0 are affected. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
PYSEC-2026-2670
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-28356 7.5

CVE-2026-28356 in rootio-multipart - Patched by Root

Root has patched CVE-2026-28356 in the rootio-multipart package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-28356
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-28356 7.5

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Record
UBUNTU-CVE-2026-28356
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10333-1 No score

python311-multipart-1.3.1-1.1 on GA media

These are all security issues fixed in the python311-multipart-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10333-1
Updated
2026-11-02
OSVUSN-8343-1 No score

multipart vulnerability

It was discovered that multipart had an ambiguous regular expression alternation when handling certain HTTP header values. A remote attacker could possibly use this issue to cause multipart to use excessive resources, leading to a denial of service.

Record
USN-8343-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
multipart
PyPI
 1.3.0 up to 1.3.1
1.3.1
multipart
PyPI
 before 1.2.2
1.2.2
multipart
Debian:13
 before 1.2.1-2+deb13u1, plus listed versions
1.2.1-2
1.2.1-2+deb13u1
multipart
Debian:14
 before 1.3.1-1, plus listed versions
1.2.1-21.3.0-11.3.0-21.3.0-3
1.3.1-1
multipart
PyPI
 before 1.2.2, plus listed versions
0.10.1.10.20.2.10.2.2
Show 7 moreShow less
0.2.30.2.40.2.51.0.01.1.01.2.01.2.1
1.2.2
multipart
PyPI
 before 1.2.2, 1.3.0 up to 1.3.1, plus listed versions
0.10.1.10.20.2.10.2.2
Show 7 moreShow less
0.2.30.2.40.2.51.0.01.1.01.2.01.2.1
1.2.21.3.1
rootio-multipart
Root:PyPI
 before 1.2.1+root.io.1
1.2.1+root.io.11.2.1+root.io.2
multipart
Root:PyPI
 before 1.2.1+aikido.2
1.2.1+aikido.2
multipart
Ubuntu:25.10
 before 1.2.1-2+deb13u1build0.25.10.1, plus listed versions
1.2.1-2
1.2.1-2+deb13u1build0.25.10.1
multipart
Ubuntu:26.04:LTS
 before 1.3.0-3ubuntu0.1, plus listed versions
1.2.1-21.3.0-3
1.3.0-3ubuntu0.1
python-multipart
openSUSE:Tumbleweed
 before 1.3.1-1.1
1.3.1-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28356 is a high vulnerability (CVSS 7.5) in Defnull Multipart, published March 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in multipart 1.3.1.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open