Vulnerabilities for python-multipart

First version without a known vulnerability: 0.0.31

Details

• GHSA-5rvq-cxj2-64vf2026-06-15

  python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

  Fixed in: 0.0.30

• GHSA-v9pg-7xvm-68hf2026-06-15

  python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

  Fixed in: 0.0.31

• GHSA-6jv3-5f52-599m2026-06-15

  python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

  Fixed in: 0.0.30

• GHSA-vffw-93wf-4j4q2026-06-15

  python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

  Fixed in: 0.0.30

• GHSA-pp6c-gr5w-3c5g2026-05-06

  python-multipart has Denial of Service via unbounded multipart part headers

  Fixed in: 0.0.27

• GHSA-mj87-hwqh-73pj2026-04-15

  python-multipart affected by Denial of Service via large multipart preamble or epilogue data

  Fixed in: 0.0.26

• GHSA-wp53-j4wj-2cfg2026-01-26

  Python-Multipart has Arbitrary File Write via Non-Default Configuration

  Fixed in: 0.0.22

• GHSA-59g5-xgcq-4qw32024-12-02

  Denial of service (DoS) via deformation `multipart/form-data` boundary

  Fixed in: 0.0.18

• GHSA-2jv5-9r88-3w3p2024-02-12

  python-multipart vulnerable to Content-Type Header ReDoS

  Fixed in: 0.0.7