CVE-2026-28356High· 7.5▾ Twilight

multipart is a fast multipart/form-data parser for python

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 12, 2026

Updated

Jul 10, 2026

CVSS

7.5

Vendor

multipart

Product

multipart

CWE

CWE-1333

Depth score

41 · Moderate

EPSS

0.72% · p52

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 10.

0.6% → 0.7%▲ 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 132 days

Mar 12, 2026Published
Disclosed via NVD
Jul 10, 2026Record revised
Last analysed / modified upstream
Jul 10, 2026EPSS first tracked
0.6%
Jul 22, 2026EPSS peak
0.6% → 0.7%

multipart CWE-1333 #nvd #osv #pip

Affected

multipart >= 1.3.0, < 1.3.1
multipart < 1.2.2

Patched in

multipart 1.3.1
multipart 1.2.2

Full technical detail▾

Overview

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-28356)

Affected packages:

multipart >= 1.3.0, < 1.3.1
multipart < 1.2.2

Patched in:

multipart 1.3.1
multipart 1.2.2

Source: https://osv.dev/vulnerability/GHSA-p2m9-wcp5-6qw3

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#osv#pip

← Back to feed

CVE-2026-28356High· 7.5▾ Twilight

multipart is a fast multipart/form-data parser for python

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 12, 2026

Updated

Jul 10, 2026

CVSS

7.5

Vendor

multipart

Product

multipart

CWE

CWE-1333

Depth score

41 · Moderate

EPSS

0.72% · p52

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 10.

0.6% → 0.7%▲ 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 132 days

Mar 12, 2026Published
Disclosed via NVD
Jul 10, 2026Record revised
Last analysed / modified upstream
Jul 10, 2026EPSS first tracked
0.6%
Jul 22, 2026EPSS peak
0.6% → 0.7%

multipart CWE-1333 #nvd #osv #pip

Affected

multipart >= 1.3.0, < 1.3.1
multipart < 1.2.2

Patched in

multipart 1.3.1
multipart 1.2.2

Full technical detail▾

Overview

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-28356)

Affected packages:

multipart >= 1.3.0, < 1.3.1
multipart < 1.2.2

Patched in:

multipart 1.3.1
multipart 1.2.2

Source: https://osv.dev/vulnerability/GHSA-p2m9-wcp5-6qw3

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#osv#pip