{
  "cveId": "CVE-2024-24762",
  "url": "https://patchblox.com/security/cve/CVE-2024-24762",
  "summary": "CVE-2024-24762 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2024-24762, released February 5, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "python-multipart: \u0060python-multipart\u0060 is a streaming multipart parser for Python",
  "description": "\u0060python-multipart\u0060 is a streaming multipart parser for Python. When using form data, \u0060python-multipart\u0060 uses a Regular Expression to parse the HTTP \u0060Content-Type\u0060 header, including options. An attacker could send a custom-made \u0060Content-Type\u0060 option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can\u0027t handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.",
  "published": "2024-02-05T07:15:00Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.01523,
  "epssPercentile": 0.74802,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-multipart",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.0.9-1",
      "fix": "DEBIAN-CVE-2024-24762",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-24762",
      "released": "2024-02-05T15:15:09Z"
    },
    {
      "platform": "linux",
      "product": "python-multipart",
      "release": "Debian 14",
      "fixedVersion": "0.0.9-1",
      "fix": "DEBIAN-CVE-2024-24762",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-24762",
      "released": "2024-02-05T15:15:09Z"
    },
    {
      "platform": "linux",
      "product": "python3-multipart",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.0.5-2ubuntu0.1~esm1",
      "fix": "python3-multipart 0.0.5-2ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-multipart-0.0.5-2ubuntu0.1-esm1",
      "released": "2026-01-26T17:16:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}