CVE-2024-53981 – python-multipart

Package

Manager: pip
Name: python-multipart
Vulnerable Version: >=0 <0.0.18

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: 0.0035 pctl0.56762

Details

Denial of service (DoS) via deformation `multipart/form-data` boundary ### Summary When parsing form data, `python-multipart` skips line breaks (CR `\r` or LF `\n`) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). ### Impact Applications that use `python-multipart` to parse form data (or use frameworks that do so) are affected. ### Original Report This security issue was reported by: - GitHub security advisory in Starlette on October 30 by @Startr4ck - Email to `python-multipart` maintainer on October 3 by @mnqazi

Metadata

Created: 2024-12-02T21:37:04Z
Modified: 2024-12-02T21:37:04Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-59g5-xgcq-4qw3/GHSA-59g5-xgcq-4qw3.json
CWE IDs: ["CWE-770"]
Alternative ID: GHSA-59g5-xgcq-4qw3
Finding: F002
Auto approve: 1