CVE-2024-24762 (GCVE-0-2024-24762)
Vulnerability from cvelistv5
Published
2024-02-05 14:33
Modified
2025-05-09 16:32
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-400 - Uncontrolled Resource Consumption
Summary
`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
References
security-advisories@github.com https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4 Patch
security-advisories@github.com https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p Exploit, Vendor Advisory
security-advisories@github.com https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74 Product
security-advisories@github.com https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5 Patch
security-advisories@github.com https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238 Broken Link
security-advisories@github.com https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc Patch
security-advisories@github.com https://github.com/tiangolo/fastapi/releases/tag/0.109.1 Product
security-advisories@github.com https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389 Broken Link
af854a3a-2127-422b-91ae-364da2661108 https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4 Patch
af854a3a-2127-422b-91ae-364da2661108 https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74 Product
af854a3a-2127-422b-91ae-364da2661108 https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5 Patch
af854a3a-2127-422b-91ae-364da2661108 https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238 Broken Link
af854a3a-2127-422b-91ae-364da2661108 https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc Patch
af854a3a-2127-422b-91ae-364da2661108 https://github.com/tiangolo/fastapi/releases/tag/0.109.1 Product
af854a3a-2127-422b-91ae-364da2661108 https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389 Broken Link
Impacted products
Vendor Product Version
Kludex python-multipart Version: 0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:28:11.928Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p"
          },
          {
            "name": "https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4"
          },
          {
            "name": "https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389"
          },
          {
            "name": "https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238"
          },
          {
            "name": "https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74"
          },
          {
            "name": "https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5"
          },
          {
            "name": "https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc"
          },
          {
            "name": "https://github.com/tiangolo/fastapi/releases/tag/0.109.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/tiangolo/fastapi/releases/tag/0.109.1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-24762",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-05T16:44:44.760876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-09T16:32:50.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/Kludex/python-multipart",
          "defaultStatus": "unaffected",
          "packageName": "python-multipart",
          "product": "python-multipart",
          "repo": "https://github.com/Kludex/python-multipart",
          "vendor": "Kludex",
          "versions": [
            {
              "lessThan": "0.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "affected"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/tiangolo/fastapi",
          "defaultStatus": "unaffected",
          "packageName": "fastapi",
          "product": "fastapi",
          "repo": "https://github.com/tiangolo/fastapi",
          "vendor": "tiangolo",
          "versions": [
            {
              "lessThan": "0.109.1",
              "status": "affected",
              "version": "0",
              "versionType": "affected"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/encode/starlette",
          "defaultStatus": "unaffected",
          "packageName": "startlette",
          "product": "starlette",
          "repo": "https://github.com/encode/starlette",
          "vendor": "encode",
          "versions": [
            {
              "lessThan": "0.36.2",
              "status": "affected",
              "version": "0",
              "versionType": "affected"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can\u0027t handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7."
            }
          ],
          "value": "`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can\u0027t handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-17T01:54:29.017Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p"
        },
        {
          "name": "https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4"
        },
        {
          "name": "https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389"
        },
        {
          "name": "https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238"
        },
        {
          "name": "https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74"
        },
        {
          "name": "https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5"
        },
        {
          "name": "https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc"
        },
        {
          "name": "https://github.com/tiangolo/fastapi/releases/tag/0.109.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tiangolo/fastapi/releases/tag/0.109.1"
        }
      ],
      "source": {
        "advisory": "GHSA-2jv5-9r88-3w3p",
        "discovery": "UNKNOWN"
      },
      "title": "python-multipart vulnerable to content-type header Regular expression Denial of Service",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-24762",
    "datePublished": "2024-02-05T14:33:06.481Z",
    "dateReserved": "2024-01-29T20:51:26.011Z",
    "dateUpdated": "2025-05-09T16:32:50.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-24762\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-02-05T15:15:09.260\",\"lastModified\":\"2025-05-05T14:14:26.363\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can\u0027t handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.\"},{\"lang\":\"es\",\"value\":\"FastAPI es un framework web para crear API con Python 3.8+ basado en sugerencias de tipo est\u00e1ndar de Python. Cuando se utilizan datos de formulario, `python-multipart` usa una expresi\u00f3n regular para analizar el encabezado HTTP `Content-Type`, incluidas las opciones. Un atacante podr\u00eda enviar una opci\u00f3n de \\\"Tipo de contenido\\\" personalizada que es muy dif\u00edcil de procesar para RegEx, consumiendo recursos de CPU y deteni\u00e9ndose indefinidamente (minutos o m\u00e1s) mientras se mantiene el bucle de evento principal. Esto significa que el proceso no puede manejar m\u00e1s solicitudes. Es un ReDoS (expresi\u00f3n regular de denegaci\u00f3n de servicio), solo se aplica a aquellos que leen datos del formulario usando `python-multipart`. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 0.109.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:*\",\"versionEndExcluding\":\"0.0.7\",\"matchCriteriaId\":\"F446019A-4E17-401B-865F-3AD3E2EB40AD\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:*\",\"versionEndExcluding\":\"0.0.7\",\"matchCriteriaId\":\"F446019A-4E17-401B-865F-3AD3E2EB40AD\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*\",\"versionEndExcluding\":\"0.36.2\",\"matchCriteriaId\":\"DE3FCFFD-84C3-4AF4-80CF-2FB38B78D1E0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:tiangolo:fastapi:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.109.1\",\"matchCriteriaId\":\"8B47D84E-D97C-4E52-91AE-270FCFA34800\"}]}]}],\"references\":[{\"url\":\"https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/tiangolo/fastapi/releases/tag/0.109.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/tiangolo/fastapi/releases/tag/0.109.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p\", \"name\": \"https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4\", \"name\": \"https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389\", \"name\": \"https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238\", \"name\": \"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74\", \"name\": \"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5\", \"name\": \"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc\", \"name\": \"https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/tiangolo/fastapi/releases/tag/0.109.1\", \"name\": \"https://github.com/tiangolo/fastapi/releases/tag/0.109.1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T23:28:11.928Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-24762\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-05T16:44:44.760876Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-09T16:32:34.246Z\"}}], \"cna\": {\"title\": \"python-multipart vulnerable to content-type header Regular expression Denial of Service\", \"source\": {\"advisory\": \"GHSA-2jv5-9r88-3w3p\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/Kludex/python-multipart\", \"vendor\": \"Kludex\", \"product\": \"python-multipart\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.0.7\", \"versionType\": \"affected\"}], \"packageName\": \"python-multipart\", \"collectionURL\": \"https://github.com/Kludex/python-multipart\", \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/tiangolo/fastapi\", \"vendor\": \"tiangolo\", \"product\": \"fastapi\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.109.1\", \"versionType\": \"affected\"}], \"packageName\": \"fastapi\", \"collectionURL\": \"https://github.com/tiangolo/fastapi\", \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/encode/starlette\", \"vendor\": \"encode\", \"product\": \"starlette\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.36.2\", \"versionType\": \"affected\"}], \"packageName\": \"startlette\", \"collectionURL\": \"https://github.com/encode/starlette\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p\", \"name\": \"https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4\", \"name\": \"https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389\", \"name\": \"https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238\", \"name\": \"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74\", \"name\": \"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5\", \"name\": \"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc\", \"name\": \"https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tiangolo/fastapi/releases/tag/0.109.1\", \"name\": \"https://github.com/tiangolo/fastapi/releases/tag/0.109.1\", \"tags\": [\"x_refsource_MISC\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can\u0027t handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can\u0027t handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-02-17T01:54:29.017Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-24762\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-09T16:32:50.015Z\", \"dateReserved\": \"2024-01-29T20:51:26.011Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-02-05T14:33:06.481Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.