Executive Summary

The vulnerability in python-multipart versions prior to 0.0.31 occurs in the parse_form() function, which failed to validate the Content-Length header before using it to limit the size of chunks read from the request body.

If a negative Content-Length value was provided, the function would read the entire request body into memory at once instead of processing it in fixed-size chunks.

This behavior could lead to memory exhaustion and degraded availability under concurrent requests.

The issue is fixed in version 0.0.31, which rejects negative Content-Length values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause memory exhaustion by loading the entire request body into memory at once when a negative Content-Length header is used.

Under concurrent requests, this can degrade the availability of the affected application, potentially slowing down or impairing its performance.

However, it does not cause a complete denial of service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects python-multipart versions prior to 0.0.31, specifically in the parse_form() function when handling a negative Content-Length header.

To detect if your system is vulnerable, you can check the installed version of python-multipart to see if it is older than 0.0.31.

• Run the command: pip show python-multipart
• Or check the version in your project's dependency files (e.g., requirements.txt or Pipfile.lock).

Additionally, to detect exploitation attempts, monitor incoming HTTP requests for negative Content-Length headers, which are unusual and indicative of this vulnerability being targeted.

• Use network monitoring tools or web server logs to filter requests with Content-Length headers less than zero.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to upgrade the python-multipart library to version 0.0.31 or later, where the vulnerability is fixed.

Version 0.0.31 rejects negative Content-Length values, preventing the memory exhaustion issue.

If upgrading is not immediately possible, consider implementing input validation or filtering at the application or web server level to reject requests with negative Content-Length headers.

Useful 0 Not Useful 0