PT-2024-20540 · Pypi+6 · Python-Multipart+6

Parentebf9723 · Published 2024-02-05 · Updated 2026-04-04 · CVE-2024-24762

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions python-multipart versions prior to 0.0.7 FastAPI version 0.109.0

Description The vulnerability is related to a Regular Expression Denial of Service (ReDoS) in the python-multipart library, which is used by FastAPI to parse form data. An attacker can send a custom-made Content-Type option that is difficult for the RegEx to process, consuming CPU resources and stalling indefinitely. This can cause the process to be unable to handle any more requests, leading to a denial of service. The vulnerability only applies when the app uses form data, parsed with python-multipart.

Recommendations For python-multipart versions prior to 0.0.7, update to version 0.0.7 or later. For FastAPI version 0.109.0, update to version 0.109.1 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1333

CWE-400

Related Identifiers

ALT-PU-2024-2022

BDU:2025-01435

CVE-2024-24762

GHSA-2JV5-9R88-3W3P

GHSA-93GM-QMQ6-W238

GHSA-QF9M-VFGH-M389

OPENSUSE-SU-2024:13664-1

OPENSUSE-SU-2024:13684-1

PYSEC-2024-38

USN-8027-1

Affected Products

Alt Linux

Debian

Fastapi

Linuxmint

Red Os

Ubuntu

Python-Multipart

References · 44

• 🔥 https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24762.json · Exploit
• 🔥 https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p · Exploit
• https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc · Patch
• https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5 · Patch
• https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4 · Patch
• https://osv.dev/vulnerability/GHSA-qf9m-vfgh-m389 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2jv5-9r88-3w3p · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24762 · Security Note
• https://osv.dev/vulnerability/USN-8027-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8027-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01435 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-24762 · Security Note
• https://ubuntu.com/security/CVE-2024-53981 · Vendor Advisory