ReDoS in multipart python parser (1.2.1, <1.3.1) causing DoS
CVE-2026-28356 Published on March 12, 2026

ReDoS in multipart 1.3.0 - `parse_options_header()`
multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.

Github Repository NVD

Vulnerability Analysis

CVE-2026-28356 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a ReDoS Vulnerability?

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:

CVE-2026-28356 has been classified to as a ReDoS vulnerability or weakness.


Products Associated with CVE-2026-28356

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Ai Inference Server
 
Red Hat Openshift Ai
 
Red Hat Lightspeed Core
 
Red Hat Openshift Lightspeed
 
Red Hat Enterprise Linux Ai
 
Red Hat Satellite
 
Red Hat Ansible Automation Platform
 

Affected Versions

defnull multipart: Red Hat AI Inference Server 3.2: Red Hat OpenShift AI 2.25: Red Hat Lightspeed Core: Red Hat OpenShift Lightspeed: Red Hat AI Inference Server: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat OpenShift AI (RHOAI): Red Hat Satellite 6: Red Hat Ansible Automation Platform 2:

Vulnerable Packages

The following package name and versions may be associated with CVE-2026-28356

Package Manager Vulnerable Package Versions Fixed In
pip multipart >= 1.3.0, < 1.3.1 1.3.1
pip multipart < 1.2.2 1.2.2

Exploit Probability

EPSS
0.39%
Percentile
30.80%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.