CVE-2026-40347

Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data

Description

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.

Scores

Weaknesses (CWE)

• CWE-400
• CWE-834

Advisories

• GHSA-mj87-hwqh-73pj — python-multipart affected by Denial of Service via large multipart preamble or epilogue data
• PYSEC-2026-3038 — python-multipart affected by Denial of Service via large multipart preamble or epilogue data

European references

• ENISA EUVD · EUVD-2026-23615
• GCVE · GCVE-0-2026-40347

CERT-FR advisories

• CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
• CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:* < 0.0.26

Affected products

References

• https://github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj
• https://github.com/Kludex/python-multipart/releases/tag/0.0.26

Sources