Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the parse_form function within the python-multipart library. The function's logic for handling the Content-Length header was flawed. Specifically, it would cast the Content-Length value to an integer without validating if it was negative. In Python, reading from a stream with a negative size (e.g., stream.read(-1)) instructs it to read until the end of the stream. An attacker could exploit this by sending a request with a negative Content-Length header, causing the server to read the entire request body into memory at once, which could lead to a denial-of-service condition due to memory exhaustion, especially under concurrent requests. The fix, introduced in commit c814948acf509cef7881fa75c969969b19239bbf, adds a check to ensure the Content-Length is not negative, thus mitigating the vulnerability.
parse_formpython_multipart/multipart.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| python-multipart | pip | < 0.0.31 | 0.0.31 |