Executive brief
python-multipart is a library used by web frameworks like FastAPI and Starlette to parse form data from HTTP requests. A malicious Content-Type header with a specially crafted option can trigger excessive CPU consumption in the regex parser, causing the server to become unresponsive and unable to handle requests (denial of service).
Technical details
A regular expression vulnerability (ReDoS) exists in the parse_options_header function when parsing HTTP Content-Type headers. An attacker sends a POST request with a malformed Content-Type header containing repeated backslashes and special characters (e.g., `Content-Type: application/x-www-form-urlencoded; !=\"\\\...\\`) that triggers catastrophic backtracking in the regex engine. This vulnerability only affects applications that parse form data (not JSON); an attacker can exhaust CPU resources on a single worker thread indefinitely, and with multiple requests can DoS the entire server. The vulnerability was patched in version 0.0.7.
Affected products
- Andrew Godwin et al. python-multipart <=0.0.6
Timeline
- 2024-02-12: disclosed
- 2024-02-12: patched: patched in version 0.0.7