CVE-2026-28356

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Mar 12, 2026, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.75% · Oct 25, 2026

A flaw was found in multipart. The parse_options_header function in multipart.py uses a regular expression with an ambiguous alternation, causing an exponential backtracking (ReDoS) when parsing a specially crafted HTTP or multipart segment headers. A web application parsing request headers or multipart/form-data streams can block request handling threads for multiple seconds per request, eventually resulting in a denial of service. multipart: denial of service via maliciously crafted HTTP or multipart segment headers This issue is only exploitable in applications using the multipart.parse_form_data function directly or indirectly when parsing request headers or multipart/form-data streams. Also, the security impact of this flaw is limited to a denial of service, there is no corruption of memory or arbitrary code execution. Due to these reasons, this vulnerability has been rated with an important severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.