CVE-2026-28356 ReDoS in multipart 1.3.0 - `parse_options_header()`
Attackers can cause denial of service in web applications using the multipart library by sending crafted headers that trigger exponential backtracking in regex parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28356?
CVE-2026-28356 is a high-severity denial of service vulnerability in defnull multipart, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.
Weakness: CWE-1333
Which versions are affected by CVE-2026-28356?
5 open source packages ship an affected version, including multipart.
| Package | Affected | Fixed in |
|---|---|---|
multipart PyPI | All versions | 1.2.2, 1.3.1 |
multipart PyPI | All versions | 1.2.2 |
multipart PyPI | All versions | 1.2.2 |
multipart PyPI | From 1.3.0 | 1.3.1 |
multipart PyPI | From 1.3.0 | 1.3.1 |
Linux distribution packages (1)
python-multipart openSUSE:Tumbleweed | All versions | 1.3.1-1.1 |
How do I fix CVE-2026-28356?
Upgrade multipart to a fixed version for your release line: 1.2.2 or 1.3.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-28356 being exploited?
There is no known exploitation of CVE-2026-28356 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-28356, DSA-6161-1, GHSA-p2m9-wcp5-6qw3, PYSEC-2026-2670, ROOT-APP-PYPI-CVE-2026-28356, UBUNTU-CVE-2026-28356 and 1 more.