NetSight
IP …
high7.5

CVE-2026-28356

multipart vulnerable to ReDoS in `parse_options_header()`

Impact

## Summary The `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams. ## Impact Any WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request. ## Affected versions All versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.

Affected packages

EcosystemPackageAffectedFixed in
pipmultipart>= 1.3.0, < 1.3.11.3.1

Affected products

ProductAffected versions
Multipart Is A Fast Multipart/Form-Data Parser For Python.
before 1.2.2

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

CWE-1333

References