CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2024-24762: python-multipart vulnerable to content-type header Regular expression Denial of Service

7.5 CVSS

Description

`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.

Classification

CVE ID: CVE-2024-24762

CVSS Base Severity: HIGH

CVSS Base Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem Types

CWE-400 Uncontrolled Resource Consumption

Affected Products

Vendor: Kludex, tiangolo, encode

Product: python-multipart, fastapi, starlette

Exploit Prediction Scoring System (EPSS)

EPSS Score: 1.8% (probability of being exploited)

EPSS Percentile: 81.91% (scored less or equal to compared to others)

EPSS Date: 2025-06-07 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: poc

SSVC Technical Impact: partial

SSVC Automatable: true

References

Timeline

2025-05-09 17:40:12 UTC
CVE

python-multipart vulnerable to content-type header Regular expression Denial of Service