High severity · published Dec 2, 2024
CVE-2024-53981
python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-multipart · Kludex
< 0.0.18 · source: vendor, CISA
Affected product
PY
python-multipart
Kludex
More from python-multipart
7.5
CVE-2026-53539
Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
7.5
CVE-2026-42561
Python-Multipart: Denial of Service via unbounded multipart part headers
7.5
CVE-2026-24486
Python-Multipart has Arbitrary File Write via Non-Default Configuration
5.3
CVE-2026-53537
Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
5.3
CVE-2026-40347
Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data