{"id":"GHSA-p2m9-wcp5-6qw3","summary":"multipart vulnerable to ReDoS in `parse_options_header()`","details":"## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.","aliases":["CVE-2026-28356","PYSEC-2026-2670"],"modified":"2026-09-10T03:50:40.128718246Z","published":"2026-03-12T18:32:18Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-03-12T18:32:18Z","nvd_published_at":"2026-03-12T17:16:50Z","cwe_ids":["CWE-1333"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28356"},{"type":"PACKAGE","url":"https://github.com/defnull/multipart"}],"affected":[{"package":{"name":"multipart","ecosystem":"PyPI","purl":"pkg:pypi/multipart"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p2m9-wcp5-6qw3/GHSA-p2m9-wcp5-6qw3.json"}},{"package":{"name":"multipart","ecosystem":"PyPI","purl":"pkg:pypi/multipart"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}],"versions":["0.1","0.1.1","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","1.0.0","1.1.0","1.2.0","1.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-p2m9-wcp5-6qw3/GHSA-p2m9-wcp5-6qw3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}