{"id":"PYSEC-2026-2670","summary":"multipart vulnerable to ReDoS in `parse_options_header()`","details":"## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.","aliases":["CVE-2026-28356","GHSA-p2m9-wcp5-6qw3"],"modified":"2026-07-13T16:32:40.103985053Z","published":"2026-07-13T14:36:42.599741Z","references":[{"type":"WEB","url":"https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28356"},{"type":"PACKAGE","url":"https://github.com/defnull/multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p2m9-wcp5-6qw3"}],"affected":[{"package":{"name":"multipart","ecosystem":"PyPI","purl":"pkg:pypi/multipart"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"},{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["0.1","0.1.1","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","1.0.0","1.1.0","1.2.0","1.2.1","1.3.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/multipart/PYSEC-2026-2670.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}