Denial of Service Vulnerability in python-multipart Package
Summary
UBUNTU-CVE-2024-53981: python-multipart is a streaming multipart parser for Python. Affects python-multipart versions 0.0.5-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-multipart package is a streaming multipart parser for Python, widely used for handling form data in web applications. It efficiently processes multipart requests, allowing developers to manage file uploads and other data submissions seamlessly. However, its design can lead to vulnerabilities if not properly managed, particularly in scenarios involving large data inputs.
Vulnerability Detail
The vulnerability identified as CVE-2024-53981 arises from the way python-multipart handles line breaks and trailing bytes during the parsing of form data. Specifically, it skips line breaks before the first boundary and any trailing bytes after the last boundary, processing one byte at a time. This behavior can lead to excessive logging when an attacker sends a malicious request with large amounts of data before or after the boundaries. The result is a significant CPU load and potential stalling of the processing thread, which can disrupt the event loop in ASGI applications, leading to a denial of service (DoS) condition. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the size of incoming requests to your application to prevent excessive resource consumption. This can be done by configuring your web server or application framework to reject requests that exceed a certain size threshold.
Conclusion
The python-multipart package has a critical vulnerability that can lead to denial of service if not addressed. It is essential to update to the patched version 0.0.18 to ensure the security and stability of your applications. Implementing request size limits can serve as a temporary measure while updates are being made.
See every vulnerability recorded for python-multipart →
FAQ
CVE-2024-53981 is a vulnerability in the python-multipart package that can lead to denial of service due to excessive CPU load from maliciously crafted requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability has a CVSS score of 7.5, indicating a high severity level that could impact application performance.
If an immediate update is not possible, consider implementing request size limits as a temporary workaround to mitigate the risk.
For more information on open-source vulnerabilities, you can visit Vulert at https://vulert.com, which monitors and alerts for vulnerabilities using manifest files.
Related vulnerabilities
Recent vulnerabilities recorded for python-multipart.
