multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regul…

The Python multipart library contains a Regular Expression Denial of Service (ReDoS) vulnerability in versions prior to 1.2.2, 1.3.1, and 1.4.0-dev. The parse_options_header() function uses a regex with ambiguous alternation that causes exponential backtracking when parsing malicious HTTP or multipart headers. This vulnerability can be exploited to perform denial of service attacks against web applications that use this library for parsing request headers or multipart/form-data streams. The issue has been patched in the specified versions.