title: python-multipart vulnerable to content-type header Regular expression Denial of Service
description: `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
collectionURL: https://github.com/Kludex/python-multipart
defaultStatus: unaffected
packageName: python-multipart
product: python-multipart
repo: https://github.com/Kludex/python-multipart
vendor: Kludex
versions:
lessThan: 0.0.7, status: affected, version: 0, versionType: affected
}
{
collectionURL: https://github.com/tiangolo/fastapi
defaultStatus: unaffected
packageName: fastapi
product: fastapi
repo: https://github.com/tiangolo/fastapi
vendor: tiangolo
versions:
lessThan: 0.109.1, status: affected, version: 0, versionType: affected
}
{
collectionURL: https://github.com/encode/starlette
defaultStatus: unaffected
packageName: startlette
product: starlette
repo: https://github.com/encode/starlette
vendor: encode
versions:
lessThan: 0.36.2, status: affected, version: 0, versionType: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL