CVE-2026-40347
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later.
Risk Assessment
Potential resource exhaustion and service unavailability due to crafted requests. This may disrupt applications that accept file uploads.
Recommendation
Upgrade python-multipart to version 0.0.26 or later. Monitor for unusual multipart requests.
Other vulnerabilities in python-multipart
See all- CVE-2026-42561High
Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.
- CVE-2026-24486High
Python-Multipart versions prior to 0.0.22 have a Path Traversal vulnerability when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary filesystem locations via a crafted filename.
Original NVD description (English source)
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS