python-multipart vulnerabilities

Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later.

Python-Multipart versions prior to 0.0.22 have a Path Traversal vulnerability when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary filesystem locations via a crafted filename.