CVE-2026-40347Medium· 5.3▾ Sunlitpython-multipart affected by Denial of Service via large multipart preamble or epilogue data
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
Last analysed / modified upstream
A denial of service vulnerability exists when parsing crafted multipart/form-data requests with large preamble or epilogue sections.
Two inefficient multipart parsing paths could be abused with attacker-controlled input.
Before the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.
An attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.
Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
python-multipart < 0.0.26Upgrade to a patched release:
python-multipart 0.0.26Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42561High· 7.5python-multipart has Denial of Service via unbounded multipart part headers
CVE-2024-53981High· 7.5Denial of service (DoS) via deformation `multipart/form-data` boundary
CVE-2024-24762High· 7.5python-multipart vulnerable to Content-Type Header ReDoS
CVE-2026-53537Low· 3.7python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
CVE-2026-53538Low· 3.7python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
CVE-2026-53540Low· 3.7python-multipart: Negative Content-Length in parse_form buffers the entire body in memory