Ubuntu alert USN-8343-1 (multipart)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8343-1] multipart vulnerability
Date:
             
 
Thu, 28 May 2026 18:11:31 +0000
Message-ID:
             
 
<E1wSfCd-0006DA-HV@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8343-1
May 28, 2026

multipart vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10

Summary:

multipart could be made to use excessive resources if it received
specially crafted input.

Software Description:
- multipart: library for handling multipart/form-data POST requests

Details:

It was discovered that multipart had an ambiguous regular expression
alternation when handling certain HTTP header values. A remote attacker
could possibly use this issue to cause multipart to use excessive
resources, leading to a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  python3-multipart               1.3.0-3ubuntu0.1

Ubuntu 25.10
  python3-multipart               1.2.1-2+deb13u1build0.25.10.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8343-1
  CVE-2026-28356

Package Information:
  https://launchpad.net/ubuntu/+source/multipart/1.3.0-3ubu...
  https://launchpad.net/ubuntu/+source/multipart/1.2.1-2+de...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoYhUIACgkQcpJm3tlz
hgHBRA//fhF208XjhEe1inkVHqqPlJBHM8nOyT/777yEjdF/TdLlYAPm3vnkSZjg
+9JyFZwX9y7kYuRXUKIQ+FYzhLOn7L3b8nEI0PfV4CDdz6x0NlRRGB2RKsdA9iIy
aK0UTAa+Fz/jnwNYDpBCddWeVoAOXzlz8QCb46gjQXbCsYnv3vtPRtp2Sna63TND
0/G7CoynP2MDfNXLgkznpQldiVmVjBSnDFHysOR6IBhQy9tqcbKORTbzMy+JYAQ/
i6UTLf1RXvTwTKaWRxRFNTTGoWuOGNpRg/l5MQcZZ2otKNpC0XzVRjF/FMFtguQC
rA/yTDNaMU3EHV1YCrXfDDKjpDtRWNG470Gsg6mnrA+T61OK1pAcVXOLatq0fJkx
nfY8TIpnFwBZM0W+B+tsV7++hz/tGIdm5b0+u4M/+mdl4Fn2AueQzSaPax/V/xkr
MmbXy4SDA5SxKcvkZ5MvEPrfyWPXZM1rFFENm40YeoSZR31ppJ0K7bb69GB/zVlg
F5y6pXLoYEaRxG+zNaTLPV2fqERsnCw0pMLiwDOMPrQTTG1nYfBq0CWk1XS2m+gy
xHXpjcfhQ0LSO/t3V8woVtxV74gsdrrGG8t9D0aYwD0cCWFF0mrvDx5sD2aaBlPK
a+I46zUC/s/HKP2PNbkfxv0JYNhHFFgm8MPqzYCzwWSBbpE4eoU=
=QBbY
-----END PGP SIGNATURE-----