CVE-2024-24762CWE-400

python-multipart vulnerable to content-type header Regular expression Denial of Service

High · published February 5, 2024

CVSS v3.1
7.5
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01523 · 74.4th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-02-05T14:33Z
EPSS history
Timeline
  • 05 FEB 14:33Z
    python-multipart vulnerable to content-type header Regular expression Denial of Service
    cvelistv5