CVE-2026-28356 Details
Description
multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.
A denial-of-service vulnerability has been identified in the multipart library for Python, specifically in versions prior to 1.2.2, 1.3.1, and 1.4.0-dev. The issue arises in the parse_options_header() function within multipart.py, where a regular expression with ambiguous alternation can lead to exponential backtracking. This behavior allows for denial-of-service attacks by causing significant slowdowns in web applications that use this library to parse request headers or multipart/form-data streams. The vulnerability can block request handling threads for several seconds per request.
Users can upgrade to multipart versions 1.2.2, 1.3.1, or 1.4.0-dev to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 12, 2026CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:10184 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:37275 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:42644 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:5809 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:6761 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:6762 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-28356 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2447059 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28356.json | redhat-SADP | |
| https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | redhat-SADP |
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| defnull multipart | All versions |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | New CVE Received | [email protected] |