Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to exponential backtracking in multipart [CVE-2026-28356]

Summary IBM Watson Speech Services Cartridge is vulnerable to exponential backtracking in multipart due to the parseoptionsheader function in multipart.py, that uses a regular expression with an ambiguous alternation, which can cause exponential backtracking ReDoS when parsing maliciously crafted...

Fedora 43 : python-multipart (2026-5c75eb75d1)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5c75eb75d1 advisory. Update to version 1.3.1 to fix CVE-2026-28356. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora: Security Advisory (FEDORA-2026-5c75eb75d1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-28356 vulnerabilities

Vulnerabilities for packages: localstack...

CVE-2026-28356

A flaw was found in multipart. The parseoptionsheader function in multipart.py uses a regular expression with an ambiguous alternation, causing an exponential backtracking ReDoS when parsing a specially crafted HTTP or multipart segment headers. A web application parsing request headers or...

warc2zim (>=2.2.1 <=2.2.2) potentially affected by CVE-2026-28356 via multipart (=1.2.1)

multipart PYPI version =1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on multipart and may be impacted: - warc2zim =2.2.1, =2.2.2 Source cves: CVE-2026-28356 Source advisory: SNYK:PYTHON-MULTIPART-15627582...

warc2zim (=2.3.0) potentially affected by CVE-2026-28356 via multipart (=1.3.0)

multipart PYPI version =1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on multipart and may be impacted: - warc2zim =2.3.0 Source cves: CVE-2026-28356 Source advisory: OSV:GHSA-P2M9-WCP5-6QW3...

Linux Distros Unpatched Vulnerability : CVE-2026-28356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parseoptionsheader function in multipart.py uses a regular...