CVE-2026-42561
Python-Multipart: Denial of Service via unbounded multipart part headers
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Python-Multipart: Denial of Service via unbounded multipart part headers
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
- Record
CVE-2026-42561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-606
- Updated
- 2026-11-02
EUVDEUVD-2026-30159
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
- Record
EUVD-2026-30159- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pp6c-gr5w-3c5g
python-multipart has Denial of Service via unbounded multipart part headers
Summary
python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion.
Impact
Applications that parse attacker-controlled multipart/form-data with affected versions of python-multipart can experience CPU exhaustion. ASGI applications using Starlette, FastAPI, or other frameworks that invoke python-multipart may have worker or event-loop delays while processing malicious upload requests.
Details
The affected parser states are HEADER_FIELD_START, HEADER_FIELD, HEADER_VALUE_START, HEADER_VALUE, and HEADER_VALUE_ALMOST_DONE. The issue can be triggered by:
- A multipart part with an oversized individual header value.
- A multipart part with many repeated header lines or an unterminated header block.
Both variants are addressed by enforcing default parser limits for maximum header count and maximum header size.
Mitigation
Upgrade to python-multipart 0.0.27 or later.
If upgrading is not immediately possible, reduce exposure by enforcing request body size limits at the server, proxy, or framework layer. This is only a mitigation; affected versions of python-multipart still parse multipart part headers without the default header count and header size limits.
- Record
GHSA-pp6c-gr5w-3c5g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
- Record
CVE-2026-42561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-606
- Updated
- 2026-11-02
OSV
Python-Multipart: Denial of Service via unbounded multipart part headers
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
- Record
CVE-2026-42561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-42561
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
- Record
DEBIAN-CVE-2026-42561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-pp6c-gr5w-3c5g
python-multipart has Denial of Service via unbounded multipart part headers
Summary
python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion.
Impact
Applications that parse attacker-controlled multipart/form-data with affected versions of python-multipart can experience CPU exhaustion. ASGI applications using Starlette, FastAPI, or other frameworks that invoke python-multipart may have worker or event-loop delays while processing malicious upload requests.
Details
The affected parser states are HEADER_FIELD_START, HEADER_FIELD, HEADER_VALUE_START, HEADER_VALUE, and HEADER_VALUE_ALMOST_DONE. The issue can be triggered by:
- A multipart part with an oversized individual header value.
- A multipart part with many repeated header lines or an unterminated header block.
Both variants are addressed by enforcing default parser limits for maximum header count and maximum header size.
Mitigation
Upgrade to python-multipart 0.0.27 or later.
If upgrading is not immediately possible, reduce exposure by enforcing request body size limits at the server, proxy, or framework layer. This is only a mitigation; affected versions of python-multipart still parse multipart part headers without the default header count and header size limits.
- Record
GHSA-pp6c-gr5w-3c5g- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVPYSEC-2026-3039
python-multipart has Denial of Service via unbounded multipart part headers
Summary
python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion.
Impact
Applications that parse attacker-controlled multipart/form-data with affected versions of python-multipart can experience CPU exhaustion. ASGI applications using Starlette, FastAPI, or other frameworks that invoke python-multipart may have worker or event-loop delays while processing malicious upload requests.
Details
The affected parser states are HEADER_FIELD_START, HEADER_FIELD, HEADER_VALUE_START, HEADER_VALUE, and HEADER_VALUE_ALMOST_DONE. The issue can be triggered by:
- A multipart part with an oversized individual header value.
- A multipart part with many repeated header lines or an unterminated header block.
Both variants are addressed by enforcing default parser limits for maximum header count and maximum header size.
Mitigation
Upgrade to python-multipart 0.0.27 or later.
If upgrading is not immediately possible, reduce exposure by enforcing request body size limits at the server, proxy, or framework layer. This is only a mitigation; affected versions of python-multipart still parse multipart part headers without the default header count and header size limits.
- Record
PYSEC-2026-3039- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2026-42561
CVE-2026-42561 in python-multipart - Patched by Root
Root has patched CVE-2026-42561 in the python-multipart package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2026-42561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-42561
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
- Record
UBUNTU-CVE-2026-42561- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1783904617 No score
TuxCare security update for python-multipart (1 CVE)
TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post6+tuxcare.
- Record
CLSA-2026-1783904617- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10797-1 No score
python311-python-multipart-0.0.28-1.1 on GA media
These are all security issues fixed in the python311-python-multipart-0.0.28-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10797-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20846-1 No score
Security update for python-python-multipart
This update for python-python-multipart fixes the following issues
- CVE-2026-40347: crafted
multipart/form-datacan cause a denial of service (bsc#1262403). - CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).
- Record
openSUSE-SU-2026:20846-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1961-1 No score
Security update for python-python-multipart
This update for python-python-multipart fixes the following issue
- CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).
- Record
SUSE-SU-2026:1961-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21999-1 No score
Security update for python-python-multipart
This update for python-python-multipart fixes the following issues
- CVE-2026-40347: crafted
multipart/form-datacan cause a denial of service (bsc#1262403). - CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).
- Record
SUSE-SU-2026:21999-1- Updated
- 2026-11-02
Affected products
- kludex python-multipart
- red hat exploit intelligence
- red hat openshift lightspeed
- red hat ai inference server
- red hat ansible automation platform 2
- red hat ansible automation platform 2.6
- red hat ansible automation platform 2.7
- red hat enterprise linux ai (rhel ai) 3
- red hat migration toolkit for applications 8.2
- red hat openshift ai (rhoai)
- red hat openshift ai 3.3
- red hat satellite 6
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-multipartPyPI |
before 0.0.27 | 0.0.27 |
python-multipartTuxCare:PyPI |
0.0.6 up to 0.0.6.post6+tuxcare, plus listed versions 0.0.6.post1+tuxcare0.0.6.post2+tuxcare0.0.6.post3+tuxcare0.0.6.post4+tuxcare0.0.6.post5+tuxcare |
0.0.6.post6+tuxcare |
python-multipartDebian:12 |
All versions, plus listed versions 0.0.17-10.0.17-20.0.17-30.0.17-40.0.17-5 Show 9 moreShow less0.0.20-10.0.20-1.10.0.20-1.1~deb13u10.0.22-10.0.26-10.0.32-10.0.5-30.0.6-10.0.9-1 |
None known |
python-multipartDebian:13 |
All versions, plus listed versions 0.0.20-10.0.20-1.10.0.20-1.1~deb13u10.0.22-10.0.26-10.0.32-1 |
None known |
python-multipartDebian:14 |
before 0.0.32-1, plus listed versions 0.0.20-10.0.20-1.10.0.20-1.1~deb13u10.0.22-10.0.26-1 |
0.0.32-1 |
python-multipartPyPI |
before 0.0.27, plus listed versions 0.0.10.0.100.0.110.0.120.0.13 Show 21 moreShow less0.0.140.0.150.0.160.0.170.0.180.0.190.0.20.0.200.0.210.0.220.0.230.0.240.0.250.0.260.0.30.0.40.0.50.0.60.0.70.0.80.0.9 |
0.0.27 |
python-multipartRoot:PyPI |
before 0.0.5+aikido.1 | 0.0.5+aikido.10.0.26+aikido.20.0.26+aikido.30.0.26+aikido.40.0.26+aikido.5 |
python-python-multipartSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 0.0.20-160000.4.1 | 0.0.20-160000.4.1 |
python-python-multipartSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 0.0.20-160000.4.1 | 0.0.20-160000.4.1 |
python-multipartUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 0.0.5-20.0.5-2ubuntu0.1~esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-multipartUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 0.0.5-30.0.6-10.0.9-10.0.9-1ubuntu0.1~esm1 |
None known |
python-multipartUbuntu:25.10 |
All versions, plus listed versions 0.0.20-1 |
None known |
python-multipartUbuntu:26.10 |
All versions, plus listed versions 0.0.20-1.10.0.26-10.0.32-1 |
None known |
python-multipartUbuntu:26.04:LTS |
All versions, plus listed versions 0.0.20-10.0.20-1.1 |
None known |
python-python-multipartopenSUSE:Tumbleweed |
before 0.0.28-1.1 | 0.0.28-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42561 is a high vulnerability (CVSS 7.5) in Kludex Python-multipart, published May 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in python-multipart 0.0.27.
References
github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g
access.redhat.com/security/cve/CVE-2026-42561
bugzilla.redhat.com/show_bug.cgi?id=2477309
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42561.json
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-42561
security-tracker.debian.org/tracker/CVE-2026-42561
pypi.org/project/python-multipart
suse.com/support/update/announcement/2026/suse-su-20261961-1
bugzilla.suse.com/1265250
ubuntu.com/security/CVE-2026-42561
cve.org/CVERecord?id=CVE-2026-42561