High severity · published Feb 5, 2024
CVE-2024-24762
python-multipart vulnerable to content-type header Regular expression Denial of Service
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
fastapi · tiangolo
before 0.109.1 · source: vendor
PY
python-multipart · Kludex
before 0.0.7 · source: vendor, NVD
ST
starlette · encode
before 0.36.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-24762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-24762
Patch
https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4
Exploit
https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p
Product
https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74
Patch
https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5
Broken Link
https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238
Patch
https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc
More from starlette
6.5
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
8.7
CVE-2024-47874
Starlette Denial of service (DoS) via multipart/form-data
7.5
CVE-2026-54283
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
7.5
CVE-2026-48818
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
7.5
CVE-2023-29159
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was…