CVE-2024-24762: FastAPI Regular Expression Denial of Service (ReDoS)
Summary
CVE-2024-24762: FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. Affects fastapi across 2 version ranges.
< 0.109.1
< 9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc
Fixed in 9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc. How to fix ↓
Also tracked for
- python-multipart · PyPI
- python-multipart · PyPI
- python-multipart · Debian:11
The same CVE-2024-24762 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. It provides a high-performance and easy-to-use platform for developing web applications. The vulnerability affects the python-multipart library used by FastAPI for parsing form data. python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. This vulnerability allows an attacker to send a custom-made Content-Type option that can consume excessive CPU resources and stall the application indefinitely, leading to a denial of service (DoS) condition. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
Vulnerability Detail
The vulnerability in FastAPI arises from the use of python-multipart for parsing form data. By sending a specially crafted Content-Type option, an attacker can trigger a Regular Expression Denial of Service (ReDoS) attack. This attack consumes significant CPU resources and can cause the application to stall for an extended period, rendering it unresponsive to other requests. The impact of this vulnerability is a denial of service, where the affected process cannot handle any more requests. The vulnerability has been patched in version 0.109.1 of FastAPI.
How To Fix
Latest published version: 0.161.1 as of 23 Oct 2026
pip install --upgrade "fastapi==0.161.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc
This is the first release that contains the fix.
pip install --upgrade "fastapi==9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update FastAPI to the patched version to address the issue.
Conclusion
The FastAPI framework is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability when using form data with the python-multipart library. This vulnerability can lead to a denial of service condition, rendering the application unresponsive. It is crucial to update FastAPI to version 0.109.1 or later to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fastapi →
FAQ
FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. It provides high performance and easy-to-use features for developing web applications.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that exploits the way regular expressions are processed. By providing a specially crafted input, an attacker can cause the regular expression matching algorithm to take an excessive amount of time, leading to a denial of service condition.
python-multipart is a library used by FastAPI for parsing form data. It includes functionality for handling multipart/form-data requests and extracting data from them.
The vulnerability allows an attacker to consume excessive CPU resources and stall the FastAPI application indefinitely. This results in a denial of service condition, where the affected process cannot handle any more requests.
Yes, this vulnerability has been patched in version 0.109.1 of FastAPI. It is recommended to update to this version or later to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for fastapi.
