The vulnerability resides in defnull's multipart library. Its parse_options_header() function relies on a regular expression that contains an ambiguous alternation, leading to exponential backtracking when parsing maliciously crafted HTTP or multipart segment headers. This results in a ReDoS condition that can be leveraged to exhaust server resources and cause a denial of service. The weakness corresponds to CWE‑1333.

All users of the defnull:multipart library whose installed version precedes the fixes are affected. Specifically, any release before 1.2.2, before 1.3.1, or before 1.4.0‑dev contains the flaw. Projects that employ versions 1.0.x through 1.3.0 or any 1.4.0‑dev snapshot prior to the release of the patched version must be updated.

The CVSS base score is 7.5, indicating moderate to high severity for denial of service. The EPSS score is below 1 %, showing a low current probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Because the flaw is triggered by forged request headers, an attacker can execute the attack remotely via the application’s HTTP interface, provided the application allows multipart form data. The impact is limited to application availability and does not affect confidentiality or integrity directly.