The multipart library for Python, maintained by defnull, contained a vulnerability (CWE-1333) in its parse_options_header() function prior to versions 1.2.2, 1.3.1, and 1.4.0-dev. The vulnerability arises from the use of a regular expression with ambiguous alternation, which can trigger exponential backtracking when parsing specially crafted HTTP or multipart headers. This behavior can be exploited to cause denial of service (DoS) by exhausting CPU resources during parsing. The vulnerability is tracked as CVE-2026-28356 with a CVSS 3.1 base score of 7.5 (high severity), indicating network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. The issue is fixed in the specified versions. Red Hat has published advisories confirming the vulnerability and providing updates.

Exploitation of this vulnerability can lead to denial of service (DoS) conditions in web applications that use the affected versions of the multipart library to parse HTTP or multipart/form-data headers. The attack causes excessive CPU consumption due to exponential backtracking in the vulnerable regular expression, potentially making the application unresponsive or degraded in availability. There is no impact on confidentiality or integrity reported.

A fix is available in multipart versions 1.2.2, 1.3.1, and 1.4.0-dev. Users and administrators should upgrade to one of these fixed versions to remediate the vulnerability. There are no vendor advisories indicating that no action is required or that the issue is already mitigated by other means. Therefore, upgrading the multipart library to a fixed version is the recommended mitigation.