CVE-2024-24762 python-multipart vulnerable to content-type header Regular expression Denial of Service

2024-02-0514:33:06

CWE-400

GitHub_M

www.cve.org

python-multipart

content-type

denial of service

vulnerability

patched

cve-2024-24762

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

47.2%

JSON

python-multipart is a streaming multipart parser for Python. When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can’t handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.

CNA Affected

[
  {
    "collectionURL": "https://github.com/Kludex/python-multipart",
    "defaultStatus": "unaffected",
    "packageName": "python-multipart",
    "product": "python-multipart",
    "repo": "https://github.com/Kludex/python-multipart",
    "vendor": "Kludex",
    "versions": [
      {
        "lessThan": "0.0.7",
        "status": "affected",
        "version": "0",
        "versionType": "affected"
      }
    ]
  },
  {
    "collectionURL": "https://github.com/tiangolo/fastapi",
    "defaultStatus": "unaffected",
    "packageName": "fastapi",
    "product": "fastapi",
    "repo": "https://github.com/tiangolo/fastapi",
    "vendor": "tiangolo",
    "versions": [
      {
        "lessThan": "0.109.1",
        "status": "affected",
        "version": "0",
        "versionType": "affected"
      }
    ]
  },
  {
    "collectionURL": "https://github.com/encode/starlette",
    "defaultStatus": "unaffected",
    "packageName": "startlette",
    "product": "starlette",
    "repo": "https://github.com/encode/starlette",
    "vendor": "encode",
    "versions": [
      {
        "lessThan": "0.36.2",
        "status": "affected",
        "version": "0",
        "versionType": "affected"
      }
    ]
  }
]