CVE-2026-42561

HighCVSS 7.5

Published: 13/05/2026(UTC)Updated: 07/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.72%

51th percentile - higher than 51% of all known CVEs

Summary

Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.

Risk Assessment

The organization is exposed to DoS attacks that can overload the server and disrupt applications using python-multipart.

Recommendation

Immediately upgrade python-multipart to version 0.0.27 or later.

Other vulnerabilities in python-multipart

CVE-2026-24486High
Python-Multipart versions prior to 0.0.22 have a Path Traversal vulnerability when using non-default configuration options UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True. An attacker can write uploaded files to arbitrary filesystem locations via a crafted filename.

Original NVD description (English source)

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.