{"id":"CVE-2026-28356","aliases":["GHSA-p2m9-wcp5-6qw3","PYSEC-2026-2670"],"url":"https://o3.security/vulnerability/CVE-2026-28356","summary":"ReDoS in multipart 1.3.0 - `parse_options_header()`","details":"## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.","published":"2026-03-12T16:45:01.070Z","modified":"2026-08-27T11:30:38.756290878Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"multipart","fixedVersion":"1.3.1"},{"ecosystem":"PyPI","name":"multipart","fixedVersion":"1.2.2"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28356.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5809"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6762"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-28356"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28356.json"},{"type":"ADVISORY","url":"https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28356"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447059"},{"type":"PACKAGE","url":"https://github.com/defnull/multipart"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T11:30:38.756290878Z"}}