CVE-2026-28356
ReDoS in multipart 1.3.0 - `parse_options_header()`
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 12, 2026
- Updated
- Aug 24, 2026
- Reserved
- Feb 26, 2026
Description
multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat-SADP |
Weaknesses
- CWE-1333 Inefficient Regular Expression Complexity
Affected Products
| Product | Versions |
|---|---|
multipartdefnull |
|
References
- https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3
- https://access.redhat.com/security/cve/CVE-2026-28356vdb-entry
- RHBZ#2447059issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28356.json
- https://access.redhat.com/errata/RHSA-2026:6761vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5809vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:6762vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10184vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:42644vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:37275vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.