PYSEC-2024-38

    Dashboard / Vulnerabilities / PYSEC-2024-38

    PYSEC-2024-38

    Published: 5 Feb 2024Last Modified: 7 Jul 2026

    Summary:

    Details: FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests. It's a ReDoS(Regular expression Denial of Service), it only applies to those reading form data, using `python-multipart`. This vulnerability has been patched in version 0.109.1.

    References: https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389, https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc, https://github.com/tiangolo/fastapi/releases/tag/0.109.1

    Affected packages

    Package

    Name: fastapi

    Purl: pkg:pypi/fastapi

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc

    Affected versions

    0.1.0
    0.1.10
    0.1.11
    0.1.12
    0.1.13
    0.1.14
    0.1.15
    0.1.16
    0.1.17
    0.1.18
    0.1.19
    0.1.2
    0.1.3
    0.1.4
    0.1.5
    0.1.6
    0.1.7
    0.1.8
    0.1.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High