Denial of service (DoS) via deformation `multipart/form-data` boundary
Summary
When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs.
An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS).
Impact
Applications that use python-multipart to parse form data (or use frameworks that do so) are affected.
Original Report
This security issue was reported by:
- GitHub security advisory in Starlette on October 30 by @Startr4ck
- Email to
python-multipartmaintainer on October 3 by @mnqazi
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | python-multipart | < 0.0.18 | 0.0.18 |
References
- https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3
- https://nvd.nist.gov/vuln/detail/CVE-2024-53981
- https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177
- https://github.com/Kludex/python-multipart
- https://pypi.org/project/python-multipart
- https://github.com/advisories/GHSA-59g5-xgcq-4qw3
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-770- Platform
- Python (PyPI)
- Package
python-multipart- Disclosed
- 02.12.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1851 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-59g5-xgcq-4qw3 - CC BY 4.0
Vulnerability history: python-multipart
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 9
- First → latest
- 02.2024 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
- Medium 1
- Low 3
Disclosures per year
- 2024: 2
- 2025: 0
- 2026: 7
-
Denial of service (DoS) via deformation `multipart/form-data` boundary this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.