CVE-2024-53981 python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary
An attacker can cause denial of service in applications using python-multipart by sending crafted requests that trigger excessive logging and high CPU usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53981?
CVE-2024-53981 is a high-severity denial of service vulnerability in Kludex python-multipart, published on 2 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.
Weakness: CWE-770
Which versions are affected by CVE-2024-53981?
3 open source packages ship an affected version, including python-multipart.
| Package | Affected | Fixed in |
|---|---|---|
python-multipart PyPI | All versions | 0.0.18 |
python-multipart PyPI | All versions | 0.0.18 |
python-multipart PyPI | All versions | 0.0.18 |
Linux distribution packages (2)
python-python-multipart openSUSE:Leap 15.6 | All versions | 0.0.9-150600.3.3.1 |
python-python-multipart openSUSE:Tumbleweed | All versions | 0.0.19-1.1 |
How do I fix CVE-2024-53981?
Upgrade python-multipart to 0.0.18 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-53981 being exploited?
There is no known exploitation of CVE-2024-53981 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1769645547, CVE-2024-7999, CVE-2024-9840, DEBIAN-CVE-2024-53981, GHSA-59g5-xgcq-4qw3, PYSEC-2026-1851 and 4 more.