Regular Expression Denial of Service in python-multipart - CVE-2024-24762
Summary
CVE-2024-24762: python-multipart is a streaming multipart parser for Python. Affects python-multipart across 5 version ranges.
< 9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc
< 13e5c26a27f4903924624736abd6131b2da80cc5
< 20f0ef6b4e4caf7d69a667c54dff57fe467109a4
< 7633d1571cc0c2792b766f67172edb9427c66899
< c83e6da1a3a6ed002ebb22138baa1664134d540c
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-multipart is a streaming multipart parser for Python, designed to handle multipart form data efficiently. It is widely used in web applications to process file uploads and form submissions. The package's ability to parse HTTP Content-Type headers is crucial for its functionality, but it also makes it susceptible to certain types of attacks, particularly those involving malformed input.
Vulnerability Detail
The vulnerability identified as CVE-2024-24762 arises from the way python-multipart processes the HTTP Content-Type header using a Regular Expression. An attacker can exploit this by sending a specially crafted Content-Type option that is complex enough to cause excessive CPU consumption. This can lead to a denial of service, as the main event loop may stall for an extended period, preventing the application from handling additional requests. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the types of Content-Type headers your application accepts. This can help mitigate the risk of denial of service attacks while you work on updating the package.
Conclusion
CVE-2024-24762 is a significant vulnerability in the python-multipart package that can lead to denial of service through the exploitation of Regular Expressions used for parsing HTTP headers. It is crucial to update to the patched version to ensure the security and reliability of your applications.
See every vulnerability recorded for python-multipart →
FAQ
CVE-2024-24762 is a vulnerability in the python-multipart package that allows attackers to exploit the Regular Expression used for parsing HTTP Content-Type headers, potentially leading to a denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your application's manifest file, such as package-lock.json, you can determine if you are affected by this vulnerability.
The primary impact is denial of service, where the application may become unresponsive due to excessive CPU usage caused by the vulnerability, preventing it from handling requests.
Yes, the vulnerability has been patched in version 0.0.7 of python-multipart. It is recommended to upgrade to this version or later to mitigate the risk.
If you cannot upgrade immediately, consider implementing input validation to limit the types of Content-Type headers accepted by your application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python-multipart.
