PYSEC-2026-3039 python-multipart has Denial of Service via unbounded multipart part headers

Summary python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many...

aeiva (>=0.8.2.4 <=0.8.2.6), aiai-cli (>=0.1.0 <=0.1.13) +63 more potentially affected by CVE-2024-53981 via python-multipart (>=0.0.10 <=0.0.17)

python-multipart PYPI version =0.0.10, =0.8.2.4, =0.1.0, =0.0.1, =0.3.0, =0.8.26, =2.0.0, =0.3.3, =0.1.6, =0.1.23, =0.0.10, =0.11.6, =0.2.0, =2024.10.0, =0.0.0a10, =0.0.0a11 - fastapi-users =14.0.0 and more Source cves: CVE-2024-53981 Source advisory: OSV:GHSA-59G5-XGCQ-4QW3...

Allocation of Resources Without Limits or Throttling

Overview python-multipart is an A streaming multipart parser for Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the multipart/form-data, when line breaks: CR \r or LF \n in front of the first boundary and any tailing bytes...