id: PYSEC-2026-2670
published: "2026-07-13T14:36:42.599741Z"
modified: "2026-07-13T16:05:00.097780Z"
aliases:
- CVE-2026-28356
- GHSA-p2m9-wcp5-6qw3
summary: multipart vulnerable to ReDoS in `parse_options_header()`
details: "## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`."
affected:
- package:
    name: multipart
    ecosystem: PyPI
    purl: pkg:pypi/multipart
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.2.2
    - introduced: 1.3.0
    - fixed: 1.3.1
  versions:
  - "0.1"
  - 0.1.1
  - "0.2"
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - 1.0.0
  - 1.1.0
  - 1.2.0
  - 1.2.1
  - 1.3.0
references:
- type: WEB
  url: https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-28356
- type: PACKAGE
  url: https://github.com/defnull/multipart
- type: PACKAGE
  url: https://pypi.org/project/multipart
- type: ADVISORY
  url: https://github.com/advisories/GHSA-p2m9-wcp5-6qw3
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H