multiparty up to 4.2.3/4.2.x redos

Summaryinfo

A vulnerability labeled as problematic has been found in multiparty up to 4.2.3/4.2.x. Affected is an unknown function. The manipulation results in redos. This vulnerability was named CVE-2026-8159. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in multiparty up to 4.2.3/4.2.x. Affected is an unknown part. The manipulation with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability. CVE summarizes:

[email protected] and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: limiting upload sizes at the proxy or gateway layer reduces but does not eliminate the attack surface, since a small header of around 8 KB is sufficient to trigger the vulnerable backtracking. Upgrade to [email protected] or higher.

The weakness was presented by aszx87410. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-8159 since 05/08/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1449.003.

The vulnerability scanner Nessus provides a plugin with the ID 314489 (Linux Distros Unpatched Vulnerability : CVE-2026-8159), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (314489). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• multiparty

Version

• 4.0
• 4.1
• 4.2
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion