CVE-2026-28356

High

Description

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

SeverityHigh

CVSS7.5

Exploit probability—

ProductMultipart

PublishedMar 12, 2026

First seenMar 12, 2026

Weakness typeCWE-1333CWE-1333

How to fix

Update

multipart1.3.1, 1.2.2 or later

Vendor advisories

Affected products

Product	Affected versions	Fixed in
multipartPyPI	1.3.0 ≤ v < 1.3.1, v < 1.2.2	1.3.1, 1.2.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.