Is CVE-2024-24762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-24762 being exploited in the wild.

How severe is CVE-2024-24762?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

fastapi (PyPI) ECOSYSTEM:introduced=0,fixed=0.109.1, GIT:introduced=0,fixed=9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc|ECOSYSTEM:introduced=0,fixed=0.109.1; python-multipart (PyPI) ECOSYSTEM:introduced=0,fixed=0.0.7.

Is there a fix for CVE-2024-24762?

Yes. fastapi (PyPI): upgrade to 0.109.1 or later; python-multipart (PyPI): upgrade to 0.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-24762 attacked?

It is attacked over the network.

Am I affected by CVE-2024-24762?

Check whether you run fastapi (PyPI) or python-multipart (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-24762: PYSEC-2026-1850 - python-multipart vulnerable to Content-Type Header ReDoS

CVE-2024-24762 · Severity: low · CVSS 3.1 · Published 2026-07-07

python-multipart is a library used by web frameworks like FastAPI and Starlette to parse form data from HTTP requests. A malicious Content-Type header with a specially crafted option can trigger excessive CPU consumption in the regex parser, causing the server to become unresponsive and unable to handle requests (denial of service).

Technologies: python-multipart (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-24762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-24762 being exploited in the wild.
How severe is CVE-2024-24762?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: fastapi (PyPI) ECOSYSTEM:introduced=0,fixed=0.109.1, GIT:introduced=0,fixed=9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc|ECOSYSTEM:introduced=0,fixed=0.109.1; python-multipart (PyPI) ECOSYSTEM:introduced=0,fixed=0.0.7.
Is there a fix for CVE-2024-24762?: Yes. fastapi (PyPI): upgrade to 0.109.1 or later; python-multipart (PyPI): upgrade to 0.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-24762 attacked?: It is attacked over the network.
Am I affected by CVE-2024-24762?: Check whether you run fastapi (PyPI) or python-multipart (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fastapi (PyPI): upgrade to 0.109.1 or later
```
pip install "fastapi>=0.109.1"
```
python-multipart (PyPI): upgrade to 0.0.7 or later
```
pip install "python-multipart>=0.0.7"
```

Technical details

A regular expression vulnerability (ReDoS) exists in the parse_options_header function when parsing HTTP Content-Type headers. An attacker sends a POST request with a malformed Content-Type header containing repeated backslashes and special characters (e.g., `Content-Type: application/x-www-form-urlencoded; !=\"\\\...\\`) that triggers catastrophic backtracking in the regex engine. This vulnerability only affects applications that parse form data (not JSON); an attacker can exhaust CPU resources on a single worker thread indefinitely, and with multiple requests can DoS the entire server. The vulnerability was patched in version 0.0.7.

Affected products

Andrew Godwin et al. python-multipart <=0.0.6

Identifiers

CVE-2024-24762
GHSA-2jv5-9r88-3w3p
GHSA-qf9m-vfgh-m389
PYSEC-2024-38
PYSEC-2026-1850

Timeline

2024-02-12: disclosed
2024-02-12: patched: patched in version 0.0.7

References

https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.