python · python-multipartCritical
python-multipart: Quadratic-time DoS in QuerystringParser fixed in 0.0.30
QuerystringParser in python-multipart performed quadratic-time scanning for field separators in application/x-www-form-urlencoded bodies, causing denial of service via crafted input.
What changed
QuerystringParser in python-multipart performed quadratic-time scanning for field separators in application/x-www-form-urlencoded bodies, causing denial of service via crafted input. Fixed in 0.0.30 by using only '&' as separator with linear scanning.
Who it affects
All users of python-multipart, including Starlette and FastAPI applications that parse url-encoded form data via request.form().
What to do today
Upgrade python-multipart to version 0.0.30 or later immediately.
The trail
Collected→
Audited→
Written→
Published