CVE-2024-53981: high-severity vulnerability in Kludex python-multipart
python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.6%
python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Kludex · python-multipartRelated CVEs — Kludex python-multipart
In the same product, most dangerous first.
CVE-2026-24486HIGHPython-Multipart has Arbitrary File Write via Non-Default ConfigurationEPSS 2.2%CVE-2024-24762HIGHpython-multipart vulnerable to content-type header Regular expression Denial of ServiceEPSS 1.5%CVE-2026-42561HIGHPython-Multipart: Denial of Service via unbounded multipart part headersEPSS 0.7%CVE-2026-53539HIGHPython-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of serviceEPSS 0.5%CVE-2026-40347MEDIUMPython-Multipart affected by Denial of Service via large multipart preamble or epilogue dataEPSS 0.4%CVE-2026-53540LOWPython-Multipart: Negative Content-Length in parse_form buffers the entire body in memoryEPSS 0.3%