7.5
High
CVE-2026-28356 multipart is a fast multipart/form-data parser for python
Description
multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat AI Inference Server 3.2 1775252598 | earliest → < 1775252598 | 1775252598 |
| Red Hat OpenShift AI 2.25 1783998857 | earliest → < 1783998857 | 1783998857 |
| Lightspeed Core | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| multipart 1.3 | 1.3.0 → < 1.3.1 | 1.3.1 |
| multipart 1.2 | earliest → < 1.2.2 | 1.2.2 |
| Red Hat OpenShift AI 3.3 1782996080 | earliest → < 1782996080 | 1782996080 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat AI Inference Server 3.2
The 63 CVEs of Red Hat AI Inference Server 3.2 →
CVE-2026-15588
Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
5.3
Medium
CVE-2026-16118
Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c
7.1
High
CVE-2026-58015
Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
5.9
Medium
CVE-2026-58014
Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
7.3
High