`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
References
Configurations
Configuration 1 (hide)
|
History
14 Nov 2024, 16:25
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:*:*:* cpe:2.3:a:encode:starlette:*:*:*:*:*:*:*:* |
|
| References | () https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4 - Patch | |
| References | () https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p - Exploit, Vendor Advisory | |
| References | () https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74 - Product | |
| References | () https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5 - Patch | |
| References | () https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238 - Broken Link | |
| References | () https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389 - Broken Link | |
| First Time |
Encode
Fastapiexpert python-multipart Encode starlette Fastapiexpert |
17 Feb 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7. |
13 Feb 2024, 00:36
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1333 | |
| First Time |
Tiangolo fastapi
Tiangolo |
|
| References | () https://github.com/tiangolo/fastapi/releases/tag/0.109.1 - Product | |
| References | () https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc - Patch | |
| References | () https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389 - Exploit, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:tiangolo:fastapi:*:*:*:*:*:*:*:* |
09 Feb 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests. It's a ReDoS(Regular expression Denial of Service), it only applies to those reading form data, using `python-multipart`. This vulnerability has been patched in version 0.109.1. |
05 Feb 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-05 15:15
Updated : 2024-11-14 16:25
NVD link : CVE-2024-24762
Mitre link : CVE-2024-24762
CVE.ORG link : CVE-2024-24762
JSON object : View
Products Affected
tiangolo
- fastapi
fastapiexpert
- python-multipart
encode
- starlette