Junglewise Threat Intelligence

CVE-2026-28356: defnull multipart ReDoS in parse_options_header

CVE-2026-28356 · Severity: high · CVSS 7.5 · Published 2026-03-12

Technologies: Defnull Multipart, Red Hat AI Inference Server. Vendors: Red Hat, PyPI.

Executive brief

The 'multipart' Python library, used for processing web form data and file uploads, contains a flaw that can be triggered by specially crafted web requests. An attacker can send malicious HTTP headers that cause the server to consume excessive CPU resources, leading to a significant slowdown or complete service outage. This affects web applications and AI services that rely on this library to handle user-submitted data.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the 'parse_options_header()' function within 'multipart.py'. The root cause is an ambiguous alternation in a regular expression that leads to exponential backtracking when processing maliciously crafted HTTP or multipart segment headers. A remote, unauthenticated attacker can exploit this by sending specially formatted requests, causing the application to hang for several seconds or longer as it consumes CPU cycles. This impact is particularly severe for WSGI and ASGI applications using 'multipart.parse_form_data()'. The issue is resolved in versions 1.2.2, 1.3.1, and 1.4.0-dev.

Affected products

  • defnull multipart < 1.2.2, >= 1.3.0 < 1.3.1, < 1.4.0-dev
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat AI Inference Server 3.2

Timeline

  • 2026-03-12: disclosed: Initial advisory published by GitHub and defnull
  • 2026-03-12: patched: Fixes released in versions 1.2.2 and 1.3.1
  • 2026-03-25: advisory: Red Hat published security advisory RHSA-2026:5809

References

Related threats