Read the docs
TI-2020-18854 Aliases CVE-2020-36661GHSA-wjp8-5g4j-4rjj

Kong lua-multipart multipart.lua is_header redos

Priority LOW 35CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1333.

Summary

A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The patch is identified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0092 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kong Inc.lua-multipart0.5.8-1—No fix listedCNA
  • lua-multipart VendorKong Inc. Affected 0.5.8-1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:konghq:multipart:0.5.8-1:*:*:*:*:lua:*:*0.5.8-1VulnerableKongHQ
  • cpe:2.3:a:konghq:multipart:0.5.8-1:*:*:*:*:lua:*:* Versions 0.5.8-1 Vulnerable ·KongHQ

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36661
  2. 2026-10-03 Alias added: GHSA-wjp8-5g4j-4rjj

References

Patch 3

  • TI-2020-17871 The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank… CVSS 3.1CRITICAL 9.8
  • TI-2025-00925 Arbitrary Code Execution in Kong Insomnia Desktop Application CVSS 4.0CRITICAL 9.3
  • TI-2026-12562 Kong API Gateway Enterprise: SAML Authentication bypass CVSS 4.0HIGH 7.7
  • TI-2026-12561 Kong API Gateway Enterprise: JWT Algorithm-Confusion CVSS 4.0HIGH 7.7
  • TI-2026-70893 SQL injection in Kong Gateway clustering communication CVSS 4.0HIGH 7.5
  • TI-2025-01158 Kong Insomnia profapi.dll untrusted search path CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences