[PR #235] [MERGED] Update dependency python-multipart to ^0.0.18 [SECURITY] #232

New issue

TheLovinator · 2026-09-02T13:09:54+02:00

TheLovinator commented

2026-09-02 13:09:54 +02:00

📋 Pull Request Information

Original PR: https://github.com/TheLovinator1/discord-twitter-webhooks/pull/235
Author: @renovate[bot]
Created: 12/2/2024
Status: ✅ Merged
Merged: 12/3/2024
Merged by: @renovate[bot]

Base: master ← Head: renovate/pypi-python-multipart-vulnerability

📝 Commits (1)

294c27a Update dependency python-multipart to ^0.0.18 [SECURITY]

📊 Changes

2 files changed (+5 additions, -8 deletions)

View changed files

📝 poetry.lock (+4 -7)
📝 pyproject.toml (+1 -1)

📄 Description

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
python-multipart (changelog)	`^0.0.9` -> `^0.0.18`

GitHub Vulnerability Alerts

CVE-2024-53981

Summary

When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs.

An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS).

Impact

Applications that use python-multipart to parse form data (or use frameworks that do so) are affected.

Original Report

This security issue was reported by:

GitHub security advisory in Starlette on October 30 by @Startr4ck
Email to python-multipart maintainer on October 3 by @mnqazi

Release Notes

Kludex/python-multipart (python-multipart)

`v0.0.18`

Compare Source

Hard break if found data after last boundary on MultipartParser #189.

`v0.0.17`

Compare Source

Handle PermissionError in fallback code for old import name #182.

`v0.0.16`

Compare Source

Add dunder attributes to multipart package #177.

`v0.0.15`

Compare Source

Replace FutureWarning to PendingDeprecationWarning #174.
Add missing files to SDist #171.

`v0.0.14`

Compare Source

Fix import scheme for multipart module (#168).

`v0.0.13`

Compare Source

Rename import to python_multipart #166.

`v0.0.12`

Compare Source

Improve error message when boundary character does not match #124.
Add mypy strict typing #140.
Enforce 100% coverage #159.

`v0.0.11`

Compare Source

Improve performance, especially in data with many CR-LF #137.
Handle invalid CRLF in header name #141.

`v0.0.10`

Compare Source

Support on_header_begin #103.
Improve type hints on FormParser #104.
Fix OnFileCallback type #106.
Improve type hints #110.
Improve type hints on File #111.
Add type hint to helper functions #112.
Minor fix for Field.repr #114.
Fix use of chunk_size parameter #136.
Allow digits and valid token chars in headers #134.
Fix headers being carried between parts #135.

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Stockholm, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/TheLovinator1/discord-twitter-webhooks/pull/235 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 12/2/2024 **Status:** ✅ Merged **Merged:** 12/3/2024 **Merged by:** [@renovate[bot]](https://github.com/apps/renovate) **Base:** `master` ← **Head:** `renovate/pypi-python-multipart-vulnerability` --- ### 📝 Commits (1) - [`294c27a`](https://github.com/TheLovinator1/discord-twitter-webhooks/commit/294c27a9804a9920f8f18d1860cea5332ebfbf17) Update dependency python-multipart to ^0.0.18 [SECURITY] ### 📊 Changes **2 files changed** (+5 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `poetry.lock` (+4 -7) 📝 `pyproject.toml` (+1 -1) </details> ### 📄 Description This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [python-multipart](https://redirect.github.com/Kludex/python-multipart) ([changelog](https://redirect.github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)) | `^0.0.9` -> `^0.0.18` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/python-multipart/0.0.18?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/python-multipart/0.0.18?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/python-multipart/0.0.9/0.0.18?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/python-multipart/0.0.9/0.0.18?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-53981](https://redirect.github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3) ### Summary When parsing form data, `python-multipart` skips line breaks (CR `\r` or LF `\n`) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). ### Impact Applications that use `python-multipart` to parse form data (or use frameworks that do so) are affected. ### Original Report This security issue was reported by: - GitHub security advisory in Starlette on October 30 by @Startr4ck - Email to `python-multipart` maintainer on October 3 by @mnqazi --- ### Release Notes <details> <summary>Kludex/python-multipart (python-multipart)</summary> ### [`v0.0.18`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0018-2024-11-28) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.17...0.0.18) - Hard break if found data after last boundary on `MultipartParser` [#189](https://redirect.github.com/Kludex/python-multipart/pull/189). ### [`v0.0.17`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0017-2024-10-31) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.16...0.0.17) - Handle PermissionError in fallback code for old import name [#182](https://redirect.github.com/Kludex/python-multipart/pull/182). ### [`v0.0.16`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0016-2024-10-27) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.15...0.0.16) - Add dunder attributes to `multipart` package [#177](https://redirect.github.com/Kludex/python-multipart/pull/177). ### [`v0.0.15`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0015-2024-10-27) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.14...0.0.15) - Replace `FutureWarning` to `PendingDeprecationWarning` [#174](https://redirect.github.com/Kludex/python-multipart/pull/174). - Add missing files to SDist [#171](https://redirect.github.com/Kludex/python-multipart/pull/171). ### [`v0.0.14`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0014-2024-10-24) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.13...0.0.14) - Fix import scheme for `multipart` module ([#168](https://redirect.github.com/Kludex/python-multipart/pull/168)). ### [`v0.0.13`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0013-2024-10-20) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.12...0.0.13) - Rename import to `python_multipart` [#166](https://redirect.github.com/Kludex/python-multipart/pull/166). ### [`v0.0.12`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0012-2024-09-29) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.11...0.0.12) - Improve error message when boundary character does not match [#124](https://redirect.github.com/Kludex/python-multipart/pull/124). - Add mypy strict typing [#140](https://redirect.github.com/Kludex/python-multipart/pull/140). - Enforce 100% coverage [#159](https://redirect.github.com/Kludex/python-multipart/pull/159). ### [`v0.0.11`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0011-2024-09-28) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.10...0.0.11) - Improve performance, especially in data with many CR-LF [#137](https://redirect.github.com/Kludex/python-multipart/pull/137). - Handle invalid CRLF in header name [#141](https://redirect.github.com/Kludex/python-multipart/pull/141). ### [`v0.0.10`](https://redirect.github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0010-2024-09-21) [Compare Source](https://redirect.github.com/Kludex/python-multipart/compare/0.0.9...0.0.10) - Support `on_header_begin` [#103](https://redirect.github.com/Kludex/python-multipart/pull/103). - Improve type hints on `FormParser` [#104](https://redirect.github.com/Kludex/python-multipart/pull/104). - Fix `OnFileCallback` type [#106](https://redirect.github.com/Kludex/python-multipart/pull/106). - Improve type hints [#110](https://redirect.github.com/Kludex/python-multipart/pull/110). - Improve type hints on `File` [#111](https://redirect.github.com/Kludex/python-multipart/pull/111). - Add type hint to helper functions [#112](https://redirect.github.com/Kludex/python-multipart/pull/112). - Minor fix for Field.**repr** [#114](https://redirect.github.com/Kludex/python-multipart/pull/114). - Fix use of chunk_size parameter [#136](https://redirect.github.com/Kludex/python-multipart/pull/136). - Allow digits and valid token chars in headers [#134](https://redirect.github.com/Kludex/python-multipart/pull/134). - Fix headers being carried between parts [#135](https://redirect.github.com/Kludex/python-multipart/pull/135). </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Europe/Stockholm, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/TheLovinator1/discord-twitter-webhooks).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

TheLovinator

2026-09-02 13:09:54 +02:00