`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-multipart | May 15, 2025 | Feb 5, 2024 |
| Suse | — | Upgrade python313-fastapiUpgrade python313-python-multipart | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade python3-multipart (Ubuntu Pro) | Feb 13, 2026 | Feb 11, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub