multipart vulnerable to ReDoS in `parse_options_header()`
Summary
The parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams.
Impact
Any WSGI or ASGI application using multipart.parse_form_data() directly or indirectly (e.g. while parsing multipart/form-data streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.
Affected versions
All versions up to and including 1.3.0 are affected. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | multipart | >= 1.3.0, < 1.3.1, < 1.2.2 | 1.3.1, 1.2.2 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-1333- Platform
- Python (PyPI)
- Package
multipart- Disclosed
- 12.03.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2670 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-p2m9-wcp5-6qw3 - CC BY 4.0
Vulnerability history: multipart
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.