Most recent entries from all

CVE-2026-42561 — Python-Multipart: Denial of Service via unbounded multipart part headers

2026-09-29T15:59:31.359442+00:00

Affected: Kludex python-multipart, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 3.3, Red Hat Satellite 6.17, Red Hat Satellite 6.19, Red Hat Exploit Intelligence, Red Hat OpenShift Lightspeed, Red Hat AI Inference Server and 4 more

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

GHSA-pp6c-gr5w-3c5g — python-multipart has Denial of Service via unbounded multipart part headers

2026-09-29T15:59:31.359662+00:00

Affected: PyPI: python-multipart

### Summary

`python-multipart` has a denial of service vulnerability in multipart part header parsing. When parsing `multipart/form-data`, `MultipartParser` previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion.

### Impact

Applications that parse attacker-controlled `multipart/form-data` with affected versions of `python-multipart` can experience CPU exhaustion. ASGI applications using Starlette, FastAPI, or other frameworks that invoke `python-multipart` may have worker or event-loop delays while processing malicious upload requests.

### Details

The affected parser states are `HEADER_FIELD_START`, `HEADER_FIELD`, `HEADER_VALUE_START`, `HEADER_VALUE`, and `HEADER_VALUE_ALMOST_DONE`. The issue can be triggered by:

- A multipart part with an oversized individual header value. - A multipart part with many repeated header lines or an unterminated header block.

Both variants are addressed by enforcing default parser limits for maximum header count and maximum header size.

### Mitigation

Upgrade to `python-multipart` `0.0.27` or later.

If upgrading is not immediately possible, reduce exposure by enforcing request body size limits at the server, proxy, or framework layer. This is only a mitigation; affected versions of `python-…

PYSEC-2026-3039 — python-multipart has Denial of Service via unbounded multipart part headers

2026-09-29T15:59:31.359773+00:00