-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| python-multipart | pip | < 0.0.18 | 0.0.18 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how trailing data after boundaries is handled in multipart.py. The commit diff shows the fix specifically modifies the MultipartState.END handling in data_callback to skip CRLF pairs atomically rather than byte-by-byte. The original code's 'i = length' approach combined with per-byte logging in a loop (implied by 'i += 1' patterns) would process large amounts of post-boundary data inefficiently. The added test in test_multipart.py verifies the logging behavior, confirming the vulnerable pattern existed in the pre-patch implementation.
Ongoing coverage of React2Shell