Detections
Analytics

SCA: security update for python-multipart (GHSA-2jv5-9r88-3w3p)

high Tenable Cloud Security Plugin ID 408967

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart`
 uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could
 send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU
 resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that
 process can't handle any more requests, leading to regular expression denial of service. This
 vulnerability has been patched in version 0.0.7. (CVE-2024-24762)

Solution

Update the python-multipart library and its related packages to version 0.0.7 or later.

See Also

https://github.com/advisories/GHSA-2jv5-9r88-3w3p

Plugin Details

Severity: High

ID: 408967

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-24762

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/12/2024

Vulnerability Publication Date: 2/5/2024

Reference Information

CVE: CVE-2024-24762

cwe: CWE-400