CVE-2026-42561
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.
Risk Assessment
The organization is exposed to DoS attacks that can overload the server and disrupt applications using python-multipart.
Recommendation
Immediately upgrade python-multipart to version 0.0.27 or later.
Other vulnerabilities in python-multipart
See all- CVE-2026-40347Medium
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later.
- CVE-2026-24486High
Python-Multipart versions prior to 0.0.22 have a Path Traversal vulnerability when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary filesystem locations via a crafted filename.
Original NVD description (English source)
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS