CVE-2024-53981
CVSS V2 None
CVSS V3 None
Description
python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.
Overview
- CVE ID
- CVE-2024-53981
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-12-02T15:57:50.232Z
- Last Modified Date
- 2024-12-02T19:59:14.830Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3 | x_refsource_CONFIRM |
| https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-53981 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53981 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-12-03 13:38:42 | Added to TrackCVE |