Vulnerability in python-multipart Could Lead to Denial of Service (DoS)

CVE-2024-53981

What is CVE-2024-53981?

The python-multipart library, a popular streaming multipart parser for Python applications, contains a vulnerability that allows an attacker to send specially crafted requests to exploit the parsing process. When processing form data, the library inadvertently skips line breaks right before the initial boundary and any trailing bytes following the last boundary. This behavior can lead to excessive logging, particularly when handling large volumes of data. An attacker may leverage this flaw to generate extensive requests resulting in high CPU usage and potential stalling of the processing thread. In applications utilizing ASGI, this may disrupt the event loop, effectively causing a denial of service (DoS) as other incoming requests are blocked. Updates are available in version 0.0.18, which mitigates these concerns.

References