Skip to content
Fencer Vulns
high 7.5

CVE-2024-24762 json

python-multipart vulnerable to content-type header Regular expression Denial of Service

published 2024-02-05 2 y ago modified 2026-09-10 1 mo ago also GHSA-2jv5-9r88-3w3p , GHSA-qf9m-vfgh-m389 , PYSEC-2024-38 , PYSEC-2026-1850 , EUVD-2024-0059

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.

Patch / fix

  • pypi python-multipart 0.0.7
  • pypi fastapi 0.109.1
  • Kludex python-multipart 0.0.7
  • tiangolo fastapi 0.109.1
  • encode starlette 0.36.2
  • python-multipart Debian 14, Debian 13 0.0.9-1

debian advisories DEBIAN-CVE-2024-24762

  • python-multipart Ubuntu Pro 22.04 LTS 0.0.5-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2024-24762

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-python-multipart openSUSE Tumbleweed 0.0.32-1.3
  • python-fastapi openSUSE Tumbleweed 0.138.0-2.1

opensuse advisories openSUSE-SU-2026:12032-1openSUSE-SU-2026:11710-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-24762 updated cvss 7.5

python-fastapi: regular expression denial of service vulnerability

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.52% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi python-multipart
<0.0.7
0.0.7
pypi fastapi
<0.109.1
0.109.1

Affected products

  • Kludex python-multipart
  • tiangolo fastapi
  • encode starlette

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.