CVE-2026-28356: multipart Package Vulnerable to ReDoS in parse_options_header()
Summary
CVE-2026-28356: multipart vulnerable to ReDoS in parse_options_header(). Affects multipart across 2 version ranges.
< 1.2.2
>= 1.3.0, < 1.3.1
Fixed in 1.2.2 or 1.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The multipart package is a Python library used for parsing and handling multipart/form-data requests, commonly utilized in web applications for file uploads and form submissions. It provides functionality to parse request headers and body content efficiently. However, the package has a vulnerability that can lead to denial of service (DoS) attacks when processing maliciously crafted HTTP headers.
Vulnerability Detail
The vulnerability arises from the parse_options_header() function in multipart.py, which employs a regular expression with ambiguous alternation. This can trigger exponential backtracking (ReDoS) when parsing specially crafted headers, leading to significant slowdowns in request handling. The impact is severe enough to block request handling threads for several seconds, making applications using this library susceptible to DoS attacks.
How To Fix
Latest published version: 2.0.1 as of 22 Oct 2026
pip install --upgrade "multipart==2.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.2.21.2.2pip install --upgrade "multipart==1.2.2" -
>= 1.3.0, < 1.3.11.3.1pip install --upgrade "multipart==1.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize and limit the size of incoming headers before they are processed by the multipart library. This can help mitigate the risk of triggering the ReDoS vulnerability.
Conclusion
The multipart package has a critical vulnerability that can lead to denial of service attacks due to improper handling of regular expressions in its parsing functions. It is essential to update to the latest patched versions to mitigate this risk and ensure the security of your web applications.
See every vulnerability recorded for multipart →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions up to and including 1.3.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
A ReDoS (Regular Expression Denial of Service) attack exploits the performance characteristics of regular expressions, causing the application to slow down significantly when processing certain inputs.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for multipart.
