Homepage

Inefficient Regular Expression Complexity The advisory has been revoked - it doesn't affect any version of package satellite/foreman-mcp-server-rhel9  (opens in a new tab)

Threat Intelligence

EPSS
0.72% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-SATELLITEFOREMANMCPSERVERRHEL9-15669440
  • published16 Mar 2026
  • disclosed12 Mar 2026
Report a new vulnerability Found a mistake?

Introduced: 12 Mar 2026

CVE-2026-28356  (opens in a new tab)
CWE-1333  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream satellite/foreman-mcp-server-rhel9 package and not the satellite/foreman-mcp-server-rhel9 package as distributed by RHEL.

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.