CVE-2026-42561High· 7.5▾ Twilightpython-multipart has Denial of Service via unbounded multipart part headers
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
0.5% → 0.7%
Last analysed / modified upstream
python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion.
Applications that parse attacker-controlled multipart/form-data with affected versions of python-multipart can experience CPU exhaustion. ASGI applications using Starlette, FastAPI, or other frameworks that invoke python-multipart may have worker or event-loop delays while processing malicious upload requests.
The affected parser states are HEADER_FIELD_START, HEADER_FIELD, HEADER_VALUE_START, HEADER_VALUE, and HEADER_VALUE_ALMOST_DONE. The issue can be triggered by:
Both variants are addressed by enforcing default parser limits for maximum header count and maximum header size.
Upgrade to python-multipart 0.0.27 or later.
If upgrading is not immediately possible, reduce exposure by enforcing request body size limits at the server, proxy, or framework layer. This is only a mitigation; affected versions of python-multipart still parse multipart part headers without the default header count and header size limits.
python-multipart < 0.0.27Upgrade to a patched release:
python-multipart 0.0.27Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40347Medium· 5.3python-multipart affected by Denial of Service via large multipart preamble or epilogue data
CVE-2024-53981High· 7.5Denial of service (DoS) via deformation `multipart/form-data` boundary
CVE-2024-24762High· 7.5python-multipart vulnerable to Content-Type Header ReDoS
CVE-2026-53537Low· 3.7python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
CVE-2026-53538Low· 3.7python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
CVE-2026-53540Low· 3.7python-multipart: Negative Content-Length in parse_form buffers the entire body in memory