USN-8027-1 (UBUNTU-CVE-2024-24762)

Vulnerability from osv_ubuntu – Published: 2026-02-11 17:05 – Updated: 2026-09-11 12:08 – Source website
VLAI
Summary
python-multipart vulnerabilities
Details

It was discovered that Python-Multipart incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause Python-Multipart to consume excessive resources, leading to a regular expression denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24762)

It was discovered that Python-Multipart did not properly sanitize line breaks during user input. An attacker could use this issue to send arbitrary input, thus preventing other requests from being processed, resulting in a denial of service. This issue was only fixed in Ubuntu 24.04 LTS. (CVE-2024-53981)

It was discovered that Python-Multipart was vulnerable to path traversal attacks. An attacker could possibly craft and upload files outside the target directory, resulting in remote code execution. (CVE-2026-24486)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-24762",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-53981",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-24486",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-multipart",
            "binary_version": "0.0.5-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "python-multipart",
        "purl": "pkg:deb/ubuntu/python-multipart@0.0.5-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.5-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.5-2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-53981",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-24486",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "python3-multipart",
            "binary_version": "0.0.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "python-multipart",
        "purl": "pkg:deb/ubuntu/python-multipart@0.0.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.9-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.5-3",
        "0.0.6-1",
        "0.0.9-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Python-Multipart incorrectly handled certain \nregular expressions. An attacker could possibly use this issue to cause\nPython-Multipart to consume excessive resources, leading to a regular \nexpression denial of service. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2024-24762)\n\nIt was discovered that Python-Multipart did not properly sanitize line\nbreaks during user input. An attacker could use this issue to send \narbitrary input, thus preventing other requests from being processed, \nresulting in a denial of service. This issue was only fixed in \nUbuntu 24.04 LTS. (CVE-2024-53981)\n\nIt was discovered that Python-Multipart was vulnerable to path traversal\nattacks. An attacker could possibly craft and upload files outside the \ntarget directory, resulting in remote code execution. (CVE-2026-24486)",
  "id": "USN-8027-1",
  "modified": "2026-09-11T12:08:47Z",
  "published": "2026-02-11T17:05:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8027-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-24762"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-53981"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-24486"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "python-multipart vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2024-24762",
    "UBUNTU-CVE-2024-53981",
    "UBUNTU-CVE-2026-24486"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.