2 results · Clear filters · Feed
-
High 7.5
python-multipart vulnerable to content-type header Regular expression Denial of Service
`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is ve…
-
High 8.2
Cross-Site Request Forgery (CSRF) in FastAPI
FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cro…