PT-2026-38278 · Pypi · Python-Multipart

Published 2026-05-06 · Updated 2026-05-16 · CVE-2026-42561

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions python-multipart versions prior to 0.0.27

Description A denial of service issue exists in the multipart part header parsing of the MultipartParser when processing multipart/form-data. The parser lacked limits on the number of part headers and the size of individual part headers. An attacker could cause excessive CPU work, leading to CPU exhaustion and potential worker or event-loop delays in ASGI applications using frameworks like Starlette or FastAPI, by sending a request with a single very large header value or many repeated headers without terminating the header block. The affected parser states include HEADER FIELD START, HEADER FIELD, HEADER VALUE START, HEADER VALUE, and HEADER VALUE ALMOST DONE.

Recommendations Update to version 0.0.27 or later. Enforce request body size limits at the server, proxy, or framework layer to reduce exposure.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-42561

ECHO-6701-0C72-DE60

GHSA-PP6C-GR5W-3C5G

OPENSUSE-SU-2026:10797-1

Affected Products

Python-Multipart

References · 15

• https://ubuntu.com/security/CVE-2026-42561 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42561 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42561 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42561 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42561 · Security Note
• https://osv.dev/vulnerability/GHSA-pp6c-gr5w-3c5g · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10797-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42561 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-42561 · Vendor Advisory
• https://github.com/Kludex/python-multipart/pull/267 · Note
• https://github.com/Kludex/python-multipart/commit/3e64f5f8caba0e5d391b0c1ad0f1c2edf9e8f911 · Note
• https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g · Note
• https://github.com/Kludex/python-multipart · Note
• https://twitter.com/CVEnew/status/2054709205819654504 · Twitter Post
• https://suse.com/security/cve/CVE-2026-42561 · Note