A critical ReDoS vulnerability in the defnull multipart library allows unauthenticated remote attackers to cause a denial of service by exploiting inefficient regular expression complexity.

The parse_options_header function in multipart.py utilizes a regular expression with ambiguous alternation, resulting in exponential backtracking (CWE-1333). An unauthenticated attacker can trigger this flaw by sending specially crafted HTTP or multipart segment headers, causing high CPU consumption and service unavailability.

The vulnerability carries a CVSS score of 7.5, reflecting a high risk to service availability. Successful exploitation results in a denial of service, potentially causing significant downtime for web applications that rely on this library for request parsing. Such disruptions can lead to operational outages, loss of customer trust, and potential service-level agreement violations.

Immediate Action: Update the multipart library to version 1.2.2, 1.3.1, or 1.4.0-dev to incorporate the necessary regular expression fixes.

Proactive Monitoring: Monitor server CPU utilization and error logs for spikes in request processing times or frequent application crashes during high-traffic periods.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter abnormally large or malformed HTTP headers before they reach the backend application.

Public Exploit Available: Unknown

Given the high impact on system availability, organizations should prioritize updating the multipart library immediately. While there is no current evidence of active exploitation, the simplicity of the attack vector necessitates prompt remediation to prevent potential service disruptions.