Vulnerability in python-multipart: Content-Type Header ReDoS
Summary
CVE-2024-24762: python-multipart vulnerable to Content-Type Header ReDoS. Affects python-multipart versions < 0.0.7. Fixed in 0.0.7. How to fix ↓
Also tracked for
- fastapi · PyPI
- python-multipart · Debian:11
- fastapi · PyPI
The same CVE-2024-24762 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-multipart is a Python library used for parsing form data in web applications. It provides functionality to parse the HTTP Content-Type header, including options. However, a vulnerability has been discovered in python-multipart that allows for a Regular expression Denial of Service (ReDoS) attack. This vulnerability can be exploited by sending a custom-made Content-Type option that overwhelms the regular expression used for parsing, leading to high CPU usage and potentially stalling the application's main event loop. This vulnerability affects versions of python-multipart up to and including 0.0.6.
Vulnerability Detail
The vulnerability in python-multipart arises from the use of a regular expression to parse the Content-Type header. An attacker can craft a malicious Content-Type option that is difficult for the regular expression to process, causing the application to consume excessive CPU resources and potentially become unresponsive. This can lead to a denial of service (DoS) condition, where the application is unable to handle further requests. The impact of this vulnerability is significant, as it affects any application that uses form data parsed with python-multipart, including frameworks like FastAPI.
How To Fix
Latest published version: 0.0.32 as of 23 Oct 2026
pip install --upgrade "python-multipart==0.0.32"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.7
This is the first release that contains the fix.
pip install --upgrade "python-multipart==0.0.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating python-multipart is not immediately feasible, a temporary workaround is to implement rate limiting or request throttling mechanisms to mitigate the impact of a potential DoS attack. This can help prevent the application from being overwhelmed by malicious requests. However, this is not a permanent solution and should be used in conjunction with updating to a patched version of python-multipart.
Conclusion
The python-multipart Content-Type Header ReDoS vulnerability poses a significant risk to applications that use form data parsed with python-multipart. It can lead to a denial of service condition, rendering the application unresponsive. To mitigate this vulnerability, it is crucial to update python-multipart to version 0.0.7 or later. Additionally, implementing rate limiting or request throttling mechanisms can provide temporary protection. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-multipart →
FAQ
python-multipart is a Python library used for parsing form data in web applications. It provides functionality to handle multipart/form-data requests and extract data from them.
A ReDoS (Regular expression Denial of Service) attack is a type of vulnerability where an attacker can exploit a regular expression pattern to cause excessive CPU usage or even stall the application's execution. This can lead to a denial of service condition, where the application becomes unresponsive.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including the python-multipart Content-Type Header ReDoS vulnerability.
Yes, a fix is available for this vulnerability. It is recommended to update python-multipart to version 0.0.7 or later. This version includes a patch for the regular expression parsing issue, preventing the ReDoS attack.
A temporary workaround for this vulnerability is to implement rate limiting or request throttling mechanisms in your application. This can help mitigate the impact of a potential DoS attack while you work on updating python-multipart to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-multipart.
