7.5

CVE-2024-24762

Exploit

python-multipart vulnerable to content-type header Regular expression Denial of Service

`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fastapiexpert ≫ Python-multipart SwPlatformpython Version < 0.0.7
Fastapiexpert ≫ Python-multipart SwPlatformpython Version < 0.0.7
   Encode ≫ Starlette SwPlatformpython Version < 0.36.2
   Tiangolo ≫ Fastapi Version < 0.109.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.52% 0.713
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4
Patch
https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p
Vendor Advisory
Exploit
https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74
Product
https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5
Patch
https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238
Broken Link
https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc
Patch
https://github.com/tiangolo/fastapi/releases/tag/0.109.1
Product
https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389
Broken Link