CVE-2024-24762: python-multipart Regular Expression Denial of Service Vulnerability
Summary
CVE-2024-24762: python-multipart vulnerable to Content-Type Header ReDoS. Affects python-multipart versions < 0.0.7. Fixed in 0.0.7. How to fix ↓
Also tracked for
- fastapi · PyPI
- python-multipart · Debian:11
- fastapi · PyPI
The same CVE-2024-24762 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-multipart is a Python library used for parsing multipart form data, commonly utilized in web applications to handle file uploads and form submissions. It provides functionality to extract and manage data from HTTP requests that contain multiple parts, such as files and text fields. However, it is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when processing certain malformed Content-Type headers, which can lead to significant performance degradation and unresponsiveness in applications that rely on this library.
Vulnerability Detail
The vulnerability arises from the way python-multipart parses the HTTP Content-Type header using a regular expression. An attacker can craft a malicious Content-Type header that exploits the regex, causing the application to consume excessive CPU resources and potentially stall indefinitely. This can result in a Denial of Service (DoS) condition, where the application becomes unresponsive to legitimate requests. The issue specifically affects applications that use python-multipart to handle form data, such as those built with FastAPI or Starlette.
How To Fix
Latest published version: 0.0.32 as of 23 Oct 2026
pip install --upgrade "python-multipart==0.0.32"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.7
This is the first release that contains the fix.
pip install --upgrade "python-multipart==0.0.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize the Content-Type header before it is processed by python-multipart. This can help mitigate the risk of ReDoS attacks by rejecting suspicious or malformed headers.
Conclusion
The CVE-2024-24762 vulnerability in python-multipart poses a significant risk of Denial of Service due to improper handling of the Content-Type header. It is crucial for developers using this library to update to the patched version and implement necessary workarounds to protect their applications from potential attacks.
See every vulnerability recorded for python-multipart →
FAQ
ReDoS is a type of denial of service attack that exploits the performance characteristics of regular expressions. By providing specially crafted input, an attacker can cause the regex engine to consume excessive CPU resources, leading to application unresponsiveness.
Versions of python-multipart prior to 0.0.7 are affected by this vulnerability. It is recommended to upgrade to version 0.0.7 or later to mitigate the risk.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By uploading your Pipfile.lock to Vulert's playground, you can check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to a Denial of Service condition, where your application becomes unresponsive and unable to handle legitimate requests, potentially affecting user experience and service availability.
Yes, you can implement input validation to sanitize the Content-Type header before processing it with python-multipart. This can help prevent the exploitation of the vulnerability until you can update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-multipart.
