CVE-2024-53981High· 7.5▾ TwilightDenial of service (DoS) via deformation `multipart/form-data` boundary
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
Last analysed / modified upstream
When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs.
An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS).
Applications that use python-multipart to parse form data (or use frameworks that do so) are affected.
This security issue was reported by:
python-multipart maintainer on October 3 by @mnqazipython-multipart < 0.0.18Upgrade to a patched release:
python-multipart 0.0.18Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42561High· 7.5python-multipart has Denial of Service via unbounded multipart part headers
CVE-2026-40347Medium· 5.3python-multipart affected by Denial of Service via large multipart preamble or epilogue data
CVE-2024-24762High· 7.5python-multipart vulnerable to Content-Type Header ReDoS
CVE-2026-53537Low· 3.7python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
CVE-2026-53538Low· 3.7python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
CVE-2026-53540Low· 3.7python-multipart: Negative Content-Length in parse_form buffers the entire body in memory