CVE-2026-28356

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parseoptionsheader() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28356.json"
}

References

Affected packages

Git / github.com/defnull/multipart

Affected ranges

Type

GIT

Repo

https://github.com/defnull/multipart

Events

Introduced

c43c0d5ad29423ae0d1ec544a360bc14016ea2df

Fixed

e6ef0a498233ddfa40f698451b31d58d57bf52c6

Database specific

{
    "versions": [
        {
            "introduced": "1.3.0"
        },
        {
            "fixed": "1.3.1"
        }
    ]
}

Type

GIT

Repo

https://github.com/defnull/multipart

Events

Introduced

Fixed

eeaff605f54386d3cda0674d025d28c23d632b40

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.2"
        }
    ]
}

Affected versions

0.*

0.2.2

v0.*

v0.1

v0.2

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.2.1

v1.3.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-28356.json"