CVE-2026-40347CWE-400CWE-834

Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data

Medium · published April 17, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-834 · Excessive Iteration
Published
2026-04-17T23:56Z
EPSS history
Timeline
  • 17 APR 23:56Z
    Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
    cvelistv5