Pypi · Python-Multipart · CVE-2024-24762
**Name of the Vulnerable Software and Affected Versions**
python-multipart versions prior to 0.0.7
FastAPI version 0.109.0
**Description**
The vulnerability is related to a Regular Expression Denial of Service (ReDoS) in the `python-multipart` library, which is used by FastAPI to parse form data. An attacker can send a custom-made `Content-Type` option that is difficult for the RegEx to process, consuming CPU resources and stalling indefinitely. This can cause the process to be unable to handle any more requests, leading to a denial of service. The vulnerability only applies when the app uses form data, parsed with `python-multipart`.
**Recommendations**
For python-multipart versions prior to 0.0.7, update to version 0.0.7 or later.
For FastAPI version 0.109.0, update to version 0.109.1 or later.