CVE-2026-40347
Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
CVE-2026-40347- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-834
- Updated
- 2026-11-02
EUVDEUVD-2026-23615
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
EUVD-2026-23615- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mj87-hwqh-73pj
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Summary
A denial of service vulnerability exists when parsing crafted multipart/form-data requests with large preamble or epilogue sections.
Details
Two inefficient multipart parsing paths could be abused with attacker-controlled input.
Before the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.
Impact
An attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.
Mitigation
Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
GHSA-mj87-hwqh-73pj- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-834
- Updated
- 2026-11-02
NVD
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
CVE-2026-40347- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-834
- Updated
- 2026-11-02
OSV
Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
CVE-2026-40347- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-834
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40347
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
DEBIAN-CVE-2026-40347- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-mj87-hwqh-73pj
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Summary
A denial of service vulnerability exists when parsing crafted multipart/form-data requests with large preamble or epilogue sections.
Details
Two inefficient multipart parsing paths could be abused with attacker-controlled input.
Before the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.
Impact
An attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.
Mitigation
Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
GHSA-mj87-hwqh-73pj- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-834
- Updated
- 2026-11-02
OSVPYSEC-2026-3038
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Summary
A denial of service vulnerability exists when parsing crafted multipart/form-data requests with large preamble or epilogue sections.
Details
Two inefficient multipart parsing paths could be abused with attacker-controlled input.
Before the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.
Impact
An attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.
Mitigation
Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
PYSEC-2026-3038- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40347
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
- Record
UBUNTU-CVE-2026-40347- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1781571262 No score
TuxCare security update for python-multipart (1 CVE)
TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post3+tuxcare.
- Record
CLSA-2026-1781571262- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10597-1 No score
python311-python-multipart-0.0.26-1.1 on GA media
These are all security issues fixed in the python311-python-multipart-0.0.26-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10597-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20846-1 No score
Security update for python-python-multipart
This update for python-python-multipart fixes the following issues
- CVE-2026-40347: crafted
multipart/form-datacan cause a denial of service (bsc#1262403). - CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).
- Record
openSUSE-SU-2026:20846-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1544-1 No score
Security update for python-python-multipart
This update for python-python-multipart fixes the following issue:
- CVE-2026-40347: crafted
multipart/form-datacan cause a denial of service (bsc#1262403).
- Record
SUSE-SU-2026:1544-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21999-1 No score
Security update for python-python-multipart
This update for python-python-multipart fixes the following issues
- CVE-2026-40347: crafted
multipart/form-datacan cause a denial of service (bsc#1262403). - CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).
- Record
SUSE-SU-2026:21999-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-multipartPyPI |
before 0.0.26 | 0.0.26 |
python-multipartTuxCare:PyPI |
0.0.6 up to 0.0.6.post3+tuxcare, plus listed versions 0.0.6.post1+tuxcare0.0.6.post2+tuxcare |
0.0.6.post3+tuxcare |
python-multipartDebian:12 |
All versions, plus listed versions 0.0.17-10.0.17-20.0.17-30.0.17-40.0.17-5 Show 9 moreShow less0.0.20-10.0.20-1.10.0.20-1.1~deb13u10.0.22-10.0.26-10.0.32-10.0.5-30.0.6-10.0.9-1 |
None known |
python-multipartDebian:13 |
All versions, plus listed versions 0.0.20-10.0.20-1.10.0.20-1.1~deb13u10.0.22-10.0.26-10.0.32-1 |
None known |
python-multipartDebian:14 |
before 0.0.26-1, plus listed versions 0.0.20-10.0.20-1.10.0.20-1.1~deb13u10.0.22-1 |
0.0.26-1 |
python-multipartPyPI |
before 0.0.26, plus listed versions 0.0.10.0.100.0.110.0.120.0.13 Show 20 moreShow less0.0.140.0.150.0.160.0.170.0.180.0.190.0.20.0.200.0.210.0.220.0.230.0.240.0.250.0.30.0.40.0.50.0.60.0.70.0.80.0.9 |
0.0.26 |
python-python-multipartSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 0.0.20-160000.4.1 | 0.0.20-160000.4.1 |
python-python-multipartSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 0.0.20-160000.4.1 | 0.0.20-160000.4.1 |
python-multipartUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 0.0.5-20.0.5-2ubuntu0.1~esm1 |
None known |
python-multipartUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 0.0.5-30.0.6-10.0.9-10.0.9-1ubuntu0.1~esm1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-multipartUbuntu:25.10 |
All versions, plus listed versions 0.0.20-1 |
None known |
python-multipartUbuntu:26.10 |
All versions, plus listed versions 0.0.20-1.10.0.26-10.0.32-1 |
None known |
python-multipartUbuntu:26.04:LTS |
All versions, plus listed versions 0.0.20-10.0.20-1.1 |
None known |
python-python-multipartopenSUSE:Tumbleweed |
before 0.0.26-1.1 | 0.0.26-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40347 is a medium vulnerability (CVSS 5.3) in Fastapiexpert Python-multipart, published April 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in python-multipart 0.0.26.
References
github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj
nvd.nist.gov/vuln/detail/CVE-2026-40347
security-tracker.debian.org/tracker/CVE-2026-40347
Show 11 moreShow less
pypi.org/project/python-multipart
suse.com/support/update/announcement/2026/suse-su-20261544-1
bugzilla.suse.com/1262403
ubuntu.com/security/CVE-2026-40347
cve.org/CVERecord?id=CVE-2026-40347