p PatchFirst

CVE-2026-28356

CVE-2026-28356 · ReDoS in multipart 1.3.0 - `parse_options_header()`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

CVSS 7.5 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • multipart

    Versions
    • >= 1.3.0, < 1.3.1: Affected
    • < 1.2.2: Affected

    No fix published

  • multipart Debian:13

    Versions
    • 1.2.1-2
    Affected ranges
    • ECOSYSTEM: < 1.2.1-2+deb13u1

    Update to 1.2.1-2+deb13u1

  • multipart Debian:14

    Versions
    • 1.2.1-2
    • 1.3.0-1
    • 1.3.0-2
    • 1.3.0-3
    Affected ranges
    • ECOSYSTEM: < 1.3.1-1

    Update to 1.3.1-1

  • multipart PyPI

    Versions
    • 1.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.0, < 1.3.1

    Update to 1.3.1

  • multipart PyPI

    Versions
    • 0.1
    • 0.1.1
    • 0.2
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.2.1
    Affected ranges
    • ECOSYSTEM: < 1.2.2

    Update to 1.2.2

  • multipart PyPI

    Versions
    • 0.1
    • 0.1.1
    • 0.2
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.3.0
    Affected ranges
    • ECOSYSTEM: < 1.2.2 ∪ ≥ 1.3.0, < 1.3.1

    Update to 1.2.2; Update to 1.3.1

  • multipart Ubuntu:25.10

    Versions
    • 1.2.1-2
    Affected ranges
    • ECOSYSTEM: < 1.2.1-2+deb13u1build0.25.10.1

    Update to 1.2.1-2+deb13u1build0.25.10.1

  • multipart Ubuntu:26.04:LTS

    Versions
    • 1.2.1-2
    • 1.3.0-3
    Affected ranges
    • ECOSYSTEM: < 1.3.0-3ubuntu0.1

    Update to 1.3.0-3ubuntu0.1

Original sources

Check your server →