CVE-2026-28356

EUVD-2026-11607

12.03.2026, 17:16

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 50%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat AI Inference Server 3.2	1774351144 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.2	1774547384 ≤ 𝑥 < *	ADP
Red Hat	Red Hat AI Inference Server 3.2	1775252598 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 2.25	1776247907 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 2.25	1776338381 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 2.25	1782397826 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 2.25	1783998774 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 2.25	1783998857 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.3	1782996080 ≤ 𝑥 < *	ADP