Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
The 'python-multipart' library is vulnerable to a Content-Type header ReDoS (CVE-2024-24762), leading to potential DoS. Review usage for affected systems. #Python #ReDoS #infosec https://www.pulsepatch.io/posts/cve-2024-24762-python-multipart-redos
Post summary
The post announces a ReDoS vulnerability in python‑multipart (CVE‑2024‑24762) and urges users to review usage, but provides no PoC, exploit code, or patch details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | encode | starlette | - | python | - |
| App | fastapiexpert | python-multipart | - | python | - |
| App | tiangolo | fastapi | - | - | - |