Read the docs
TI-2024-36140 Aliases CVE-2024-53981GHSA-59g5-xgcq-4qw3

python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00635 50th percentileScored 2026-11-07
Fix Partial python-multipart (Kludex): 0.0.18python-multipart (PyPI): 0.0.18Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kludexpython-multipartbefore 0.0.180.0.18Patch availableCNA
—python-multipart (PyPI)before 0.0.180.0.18Patch availableGHSA-59g5-xgcq-4qw3
  • python-multipart VendorKludex Affected before 0.0.18 Fixed in 0.0.18 Patch available CNA
  • python-multipart (PyPI) Vendor— Affected before 0.0.18 Fixed in 0.0.18 Patch available GHSA-59g5-xgcq-4qw3

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:kludex:python-multipart:*:*:*:*:*:*:*:*——Kludex
  • cpe:2.3:a:kludex:python-multipart:*:*:*:*:*:*:*:* Versions — — ·Kludex

Remediation

  • Fix · CNA python-multipart (Kludex) Fixed in 0.0.18
  • Fix · GHSA-59g5-xgcq-4qw3 python-multipart (PyPI) Fixed in 0.0.18 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-53981
  2. 2026-10-03 Alias added: GHSA-59g5-xgcq-4qw3
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 3

  • TI-2025-38917 Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse CVSS 3.1HIGH 7.5
  • TI-2026-30841 Python-Multipart: Denial of Service via unbounded multipart part headers CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences