Debian Python-Multipart vulnerabilities

CVE-2026-24486 [HIGH] CVE-2026-24486: python-multipart - Python-Multipart is a streaming multipart parser for Python. Prior to version 0.... Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version

CVE-2024-53981 [HIGH] CVE-2024-53981: python-multipart - python-multipart is a streaming multipart parser for Python. When parsing form d... python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse t

CVE-2024-24762 [HIGH] CVE-2024-24762: python-multipart - `python-multipart` is a streaming multipart parser for Python. When using form d... `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or