Summary
It was discovered that multipart had an ambiguous regular expression
alternation when handling certain HTTP header values. A remote attacker
could possibly use this issue to cause multipart to use excessive
resources, leading to a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | multipart | 1.2.1-2+deb13u1build0.25.10.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | multipart | 1.3.0-3ubuntu0.1 |
References
-
report
https://ubuntu.com/security/CVE-2026-28356