HIGH7.5PyPI
GHSA-2jv5-9r88-3w3p· CVE-2024-24762, GHSA-qf9m-vfgh-m389python-multipart vulnerable to Content-Type Header ReDoS
Modified: 9/10/2026
package
PyPI/python-multipart
pkg:pypi/python-multipart
HIGH7.5PyPI
GHSA-59g5-xgcq-4qw3· CVE-2024-53981, PYSEC-2026-1851Denial of service (DoS) via deformation `multipart/form-data` boundary
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-5rvq-cxj2-64vf· CVE-2026-53539, PYSEC-2026-3036python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Modified: 9/10/2026
LOW3.7PyPI
GHSA-6jv3-5f52-599m· CVE-2026-53538, PYSEC-2026-3037python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-mj87-hwqh-73pj· CVE-2026-40347, PYSEC-2026-3038python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-pp6c-gr5w-3c5g· CVE-2026-42561, PYSEC-2026-3039python-multipart has Denial of Service via unbounded multipart part headers
Modified: 9/10/2026
LOW3.7PyPI
GHSA-v9pg-7xvm-68hf· CVE-2026-53540, PYSEC-2026-3040python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
Modified: 9/10/2026
LOW3.7PyPI
GHSA-vffw-93wf-4j4q· CVE-2026-53537, PYSEC-2026-3041python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Modified: 9/10/2026
HIGH8.6PyPI
GHSA-wp53-j4wj-2cfg· CVE-2026-24486, PYSEC-2026-1852Python-Multipart has Arbitrary File Write via Non-Default Configuration
Modified: 9/10/2026
HIGH7.5PyPI
PYSEC-2026-1850· CVE-2024-24762, GHSA-2jv5-9r88-3w3ppython-multipart vulnerable to Content-Type Header ReDoS
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1851· CVE-2024-53981, GHSA-59g5-xgcq-4qw3Denial of service (DoS) via deformation `multipart/form-data` boundary
Modified: 7/7/2026
HIGH8.6PyPI
PYSEC-2026-1852· CVE-2026-24486, GHSA-wp53-j4wj-2cfgPython-Multipart has Arbitrary File Write via Non-Default Configuration
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-3036· CVE-2026-53539, GHSA-5rvq-cxj2-64vfpython-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Modified: 7/13/2026
LOW3.7PyPI
PYSEC-2026-3037· CVE-2026-53538, GHSA-6jv3-5f52-599mpython-multipart: Semicolon treated as querystring field separator enables parameter smuggling
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-3038· CVE-2026-40347, GHSA-mj87-hwqh-73pjpython-multipart affected by Denial of Service via large multipart preamble or epilogue data
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-3039· CVE-2026-42561, GHSA-pp6c-gr5w-3c5gpython-multipart has Denial of Service via unbounded multipart part headers
Modified: 7/13/2026
LOW3.7PyPI
PYSEC-2026-3040· CVE-2026-53540, GHSA-v9pg-7xvm-68hfpython-multipart: Negative Content-Length in parse_form buffers the entire body in memory
Modified: 7/13/2026
LOW3.7PyPI
PYSEC-2026-3041· CVE-2026-53537, GHSA-vffw-93wf-4j4qpython-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Modified: 7/13/2026