PT-2026-33212 · Pypi · Python-Multipart

Published 2026-04-15 · Updated 2026-04-21 · CVE-2026-40347

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Python-Multipart versions prior to 0.0.26

Description An issue exists when parsing crafted multipart/form-data requests containing large preamble or epilogue sections. Two inefficient parsing paths can be abused: the parser handles leading CR and LF bytes inefficiently while searching for the first boundary, and it continues processing trailing epilogue data after the closing boundary instead of discarding it. This allows an attacker to send oversized malformed multipart bodies that consume excessive CPU time, reducing request-handling capacity and delaying legitimate requests, which degrades availability.

Recommendations Upgrade to version 0.0.26 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-834

CWE-400

Related Identifiers

CVE-2026-40347

GHSA-MJ87-HWQH-73PJ

OPENSUSE-SU-2026:10597-1

Affected Products

Python-Multipart

References · 14

• https://github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40347 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10597-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40347 · Security Note
• https://osv.dev/vulnerability/GHSA-mj87-hwqh-73pj · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40347 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40347 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40347 · Vendor Advisory
• https://github.com/Kludex/python-multipart · Note
• https://github.com/Kludex/python-multipart/pull/259 · Note
• https://github.com/Kludex/python-multipart/releases/tag/0.0.26 · Note
• https://suse.com/security/cve/CVE-2026-40347 · Note
• https://twitter.com/CVEnew/status/2045467345099821385 · Twitter Post