Denial of Service Vulnerability in python-multipart Package
Summary
UBUNTU-CVE-2024-24762: python-multipart is a streaming multipart parser for Python. Affects python-multipart versions 0.0.5-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The python-multipart package is a streaming multipart parser for Python, designed to handle form data efficiently. It allows developers to process multipart HTTP requests, making it a crucial component for web applications that handle file uploads and form submissions. However, it is susceptible to a specific vulnerability that can lead to denial of service, affecting the performance and availability of applications using this package.
Vulnerability Detail
The vulnerability arises from the way python-multipart parses the HTTP Content-Type header using a Regular Expression. An attacker can craft a malicious Content-Type option that is complex enough to cause excessive CPU consumption during parsing. This can stall the main event loop for an extended period, preventing the application from handling additional requests and leading to a denial of service. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on your application to mitigate the impact of potential denial of service attacks. Additionally, consider validating and sanitizing the Content-Type header before processing it to avoid triggering the vulnerability.
Conclusion
The python-multipart package has a significant vulnerability that can lead to denial of service attacks through malicious Content-Type headers. It is crucial to update to the patched version 0.0.7 to mitigate this risk. Implementing workarounds and utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python-multipart →
FAQ
The python-multipart package is a library for parsing multipart HTTP requests in Python, commonly used for handling file uploads and form submissions.
This vulnerability can lead to denial of service, where your application becomes unresponsive due to excessive CPU usage caused by malicious Content-Type headers.
If immediate updates are not possible, implement rate limiting and validate Content-Type headers to reduce the risk of exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for python-multipart.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
