{"id":"CVE-2026-28356","aliases":["DEBIAN-CVE-2026-28356","DSA-6161-1","EUVD-2026-11607","GHSA-p2m9-wcp5-6qw3","PYSEC-2026-2670","ROOT-APP-PYPI-CVE-2026-28356","UBUNTU-CVE-2026-28356","USN-8343-1","openSUSE-SU-2026:10333-1"],"status":"published","title":"ReDoS in multipart 1.3.0 - `parse_options_header()`","description":"multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00841,"percentile":0.58316,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-03-12T00:00:00Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"PyPI","package":"multipart","fixed_in":["1.3.1","1.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"multipart","fixed_in":["1.2.1-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"multipart","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-multipart","fixed_in":["1.2.1+root.io.1","1.2.1+root.io.2"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"multipart","fixed_in":["1.2.1+aikido.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"multipart","fixed_in":["1.2.1-2+deb13u1build0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"multipart","fixed_in":["1.3.0-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-multipart","fixed_in":["1.3.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2+deb13u1"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}],"versions":["1.2.1-2","1.3.0-1","1.3.0-2","1.3.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2+deb13u1"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"PyPI","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}],"versions":["0.1","0.1.1","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","1.0.0","1.1.0","1.2.0","1.2.1"]},{"source":"osv","ecosystem":"PyPI","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"},{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["0.1","0.1.1","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","1.0.0","1.1.0","1.2.0","1.2.1","1.3.0"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1+root.io.1"},{"fixed":"1.2.1+root.io.2"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1+aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2+deb13u1build0.25.10.1"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3ubuntu0.1"}]}],"versions":["1.2.1-2","1.3.0-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2+deb13u1build0.25.10.1"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-3ubuntu0.1"}]}],"versions":["1.2.1-2","1.3.0-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.1"}]}]}],"products":[{"vendor":"defnull","product":"multipart"},{"vendor":"red hat","product":"lightspeed core"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat satellite 6"}],"references":[{"url":"https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28356","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447059","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28356.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6761","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5809","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6762","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28356","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p2m9-wcp5-6qw3","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28356.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-28356","tags":["advisory"]},{"url":"https://github.com/defnull/multipart","tags":["package"]},{"url":"https://pypi.org/project/multipart","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-28356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28356","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8343-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28356","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-28356","title":"ReDoS in multipart 1.3.0 - `parse_options_header()`","description":"multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.","status":"published","published":"2026-03-12T16:45:01.07Z","modified":"2026-08-24T12:07:08.274Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1333","CWE-1333"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-11607","description":"multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.","status":"published","published":"2026-03-12T16:45:01Z","modified":"2026-08-24T12:07:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:35.296422Z"}],"ghsa":[{"id":"GHSA-p2m9-wcp5-6qw3","title":"multipart vulnerable to ReDoS in `parse_options_header()`","description":"## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.","status":"published","published":"2026-03-12T18:32:18Z","modified":"2026-03-12T18:32:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:39:35.644357Z"}],"nvd":[{"id":"CVE-2026-28356","description":"multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.","status":"published","published":"2026-03-12T17:16:50.08Z","modified":"2026-08-24T13:17:53.46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-28356","title":"ReDoS in multipart 1.3.0 - `parse_options_header()`","description":"multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.","status":"published","published":"2026-03-12T16:45:01.07Z","modified":"2026-10-28T02:30:37.432178962Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-28356","description":"multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.","status":"published","published":"2026-03-12T17:16:50.08Z","modified":"2026-10-01T03:03:02.813562312Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-p2m9-wcp5-6qw3","title":"multipart vulnerable to ReDoS in `parse_options_header()`","description":"## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.","status":"published","published":"2026-03-12T18:32:18Z","modified":"2026-09-10T03:50:40.128718246Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"PYSEC-2026-2670","title":"multipart vulnerable to ReDoS in `parse_options_header()`","description":"## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.","status":"published","published":"2026-07-13T14:36:42.599741Z","modified":"2026-07-13T16:32:40.103985053Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"ROOT-APP-PYPI-CVE-2026-28356","title":"CVE-2026-28356 in rootio-multipart - Patched by Root","description":"Root has patched CVE-2026-28356 in the rootio-multipart package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T14:55:28Z","modified":"2026-06-03T19:30:15.583284382Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2026-28356","description":"multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.","status":"published","published":"2026-03-12T17:16:00Z","modified":"2026-06-30T18:17:45.456313076Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"DSA-6161-1","title":"multipart - security update","status":"published","published":"2026-03-12T00:00:00Z","modified":"2026-03-23T05:05:39.89540619Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2026:10333-1","title":"python311-multipart-1.3.1-1.1 on GA media","description":"These are all security issues fixed in the python311-multipart-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:24:07.168754Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"USN-8343-1","title":"multipart vulnerability","description":"It was discovered that multipart had an ambiguous regular expression\nalternation when handling certain HTTP header values. A remote attacker\ncould possibly use this issue to cause multipart to use excessive\nresources, leading to a denial of service.","status":"published","published":"2026-05-28T17:53:21Z","modified":"2026-06-30T18:16:42.766265696Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}