PT-2026-25010 · Pypi · Multipart

Sharanxp · Published 2026-01-01 · Updated 2026-05-28 · CVE-2026-28356

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions multipart versions prior to 1.2.2 multipart versions prior to 1.3.1 multipart versions prior to 1.4.0-dev

Description The parse options header() function within the multipart.py file utilizes a regular expression containing an ambiguous alternation. This can lead to exponential backtracking (ReDoS) when processing maliciously crafted HTTP or multipart segment headers. This issue can be exploited to launch denial of service (DoS) attacks against web applications that employ this library to parse request headers or multipart/form-data streams. ReDoS occurs when a regular expression engine takes an excessively long time to process a specific input due to backtracking. An ambiguous alternation in a regular expression allows multiple ways to match a portion of the input, causing the engine to explore numerous possibilities, leading to exponential time complexity in the worst-case scenario.

Recommendations Update to multipart version 1.2.2 or later. Update to multipart version 1.3.1 or later. Update to multipart version 1.4.0-dev or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-28356

GHSA-P2M9-WCP5-6QW3

OPENSUSE-SU-2026:10333-1

USN-8343-1

Affected Products

Multipart

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28356.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-28356 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2m9-wcp5-6qw3 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28356 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28356 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-28356 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8343-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28356 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-28356 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8343-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28356 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10333-1 · Vendor Advisory
• https://github.com/defnull/multipart · Note
• https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3 · Note