{"id":"CVE-2026-40347","aliases":["CLSA-2026-1781571262","DEBIAN-CVE-2026-40347","EUVD-2026-23615","GHSA-mj87-hwqh-73pj","PYSEC-2026-3038","SUSE-SU-2026:1544-1","SUSE-SU-2026:21999-1","UBUNTU-CVE-2026-40347","openSUSE-SU-2026:10597-1","openSUSE-SU-2026:20846-1"],"status":"published","title":"Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data","description":"Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00351,"percentile":0.28949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-834"],"published":"2026-04-15T19:45:44Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"PyPI","package":"python-multipart","fixed_in":["0.0.26"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"python-multipart","fixed_in":["0.0.6.post3+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-multipart","fixed_in":["0.0.26-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-python-multipart","fixed_in":["0.0.26-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.26"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.6"},{"fixed":"0.0.6.post3+tuxcare"}]}],"versions":["0.0.6","0.0.6.post1+tuxcare","0.0.6.post2+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.17-1","0.0.17-2","0.0.17-3","0.0.17-4","0.0.17-5","0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1","0.0.32-1","0.0.5-3","0.0.6-1","0.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1","0.0.32-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.26-1"}]}],"versions":["0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1"]},{"source":"osv","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.26"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.26"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.5-2","0.0.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.5-3","0.0.6-1","0.0.9-1","0.0.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1.1","0.0.26-1","0.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1","0.0.20-1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.26-1.1"}]}]}],"products":[{"vendor":"fastapiexpert","product":"python-multipart"},{"vendor":"kludex","product":"python-multipart"}],"references":[{"url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.26","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40347","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mj87-hwqh-73pj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40347.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40347","tags":["advisory"]},{"url":"https://github.com/Kludex/python-multipart","tags":["package"]},{"url":"https://pypi.org/project/python-multipart","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261544-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262403","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40347","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621999-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265250","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42561","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-40347","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40347","tags":["report"]},{"url":"https://github.com/Kludex/python-multipart/pull/259","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40347","title":"Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data","description":"Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-17T23:56:50.777Z","modified":"2026-04-20T15:46:40.011Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-23615","description":"Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-17T23:56:50Z","modified":"2026-04-20T15:46:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:24:22.446697Z"}],"ghsa":[{"id":"GHSA-mj87-hwqh-73pj","title":"python-multipart affected by Denial of Service via large multipart preamble or epilogue data","description":"### Summary\n\nA denial of service vulnerability exists when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections.\n\n### Details\n\nTwo inefficient multipart parsing paths could be abused with attacker-controlled input.\n\nBefore the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.\n\n### Impact\n\nAn attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.\n\n### Mitigation\n\nUpgrade to version `0.0.26` or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-15T19:45:44Z","modified":"2026-04-24T20:51:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T14:39:57.650091Z"}],"nvd":[{"id":"CVE-2026-40347","description":"Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-18T00:16:38.52Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"CVE-2026-40347","title":"Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data","description":"Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-17T23:56:50.777Z","modified":"2026-10-28T02:30:21.336892584Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-40347","description":"Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-18T00:16:38.52Z","modified":"2026-10-27T09:47:44.130861221Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-mj87-hwqh-73pj","title":"python-multipart affected by Denial of Service via large multipart preamble or epilogue data","description":"### Summary\n\nA denial of service vulnerability exists when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections.\n\n### Details\n\nTwo inefficient multipart parsing paths could be abused with attacker-controlled input.\n\nBefore the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.\n\n### Impact\n\nAn attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.\n\n### Mitigation\n\nUpgrade to version `0.0.26` or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-15T19:45:44Z","modified":"2026-09-10T03:51:02.322677211Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-834"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"PYSEC-2026-3038","title":"python-multipart affected by Denial of Service via large multipart preamble or epilogue data","description":"### Summary\n\nA denial of service vulnerability exists when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections.\n\n### Details\n\nTwo inefficient multipart parsing paths could be abused with attacker-controlled input.\n\nBefore the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.\n\n### Impact\n\nAn attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.\n\n### Mitigation\n\nUpgrade to version `0.0.26` or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-07-13T15:02:48.004841Z","modified":"2026-07-13T16:33:29.086443165Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"UBUNTU-CVE-2026-40347","description":"Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.","status":"published","published":"2026-04-18T00:16:00Z","modified":"2026-10-17T12:58:54.296443724Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"CLSA-2026-1781571262","title":"TuxCare security update for python-multipart (1 CVE)","description":"TuxCare rebuilt python-multipart to address 1 CVE. Fixed in 0.0.6.post3+tuxcare.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:48:00.940680842Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2026:10597-1","title":"python311-python-multipart-0.0.26-1.1 on GA media","description":"These are all security issues fixed in the python311-python-multipart-0.0.26-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-21T00:00:00Z","modified":"2026-04-22T08:17:03.03286Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20846-1","title":"Security update for python-python-multipart","description":"This update for python-python-multipart fixes the following issues\n\n- CVE-2026-40347: crafted `multipart/form-data` can cause a denial of service (bsc#1262403).\n- CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).\n","status":"published","published":"2026-05-29T14:27:24Z","modified":"2026-06-02T18:24:28.364254139Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1544-1","title":"Security update for python-python-multipart","description":"This update for python-python-multipart fixes the following issue:\n\n- CVE-2026-40347: crafted `multipart/form-data` can cause a denial of service (bsc#1262403).\n","status":"withdrawn","published":"2026-04-22T07:22:51Z","modified":"2026-07-13T14:00:33.973413525Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21999-1","title":"Security update for python-python-multipart","description":"This update for python-python-multipart fixes the following issues\n\n- CVE-2026-40347: crafted `multipart/form-data` can cause a denial of service (bsc#1262403).\n- CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).\n","status":"published","published":"2026-05-29T14:26:56Z","modified":"2026-06-09T18:24:18.613119268Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}