PYSEC-2026-2670

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/multipart/PYSEC-2026-2670.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2670
Aliases
Published
2026-07-13T14:36:42.599741Z
Modified
2026-07-13T16:32:40.103985053Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
multipart vulnerable to ReDoS in `parse_options_header()`
Details

Summary

The parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams.

Impact

Any WSGI or ASGI application using multipart.parse_form_data() directly or indirectly (e.g. while parsing multipart/form-data streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.

Affected versions

All versions up to and including 1.3.0 are affected. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

References

Affected packages

PyPI / multipart

Package

Name
multipart
View open source insights on deps.dev
Purl
pkg:pypi/multipart

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.2
Introduced
1.3.0
Fixed
1.3.1

Affected versions

0.*
0.1
0.1.1
0.2
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
1.*
1.0.0
1.1.0
1.2.0
1.2.1
1.3.0

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/multipart/PYSEC-2026-2670.yaml"