CVE catalog

CVE-2026-42561

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data,

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.74% · Oct 25, 2026

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-multipartsid0.0.32-1fixed
Debianpython-multipartforky0.0.32-1fixed
Debianpython-multiparttrixie0.0.20-1.1~deb13u1vulnerable
Debianpython-multipartbookworm0.0.5-3vulnerable
Cpepython-multipartNot reportedNot reportedvulnerable
PyPIpython-multipartNot reported0.0.27fixed
Opensusepython-python-multiparttumbleweed0.0.28-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-multipartsourcesid0.0.32-1not yet assignedNot reported[1136702]
Debianpython-multipartsourceforky0.0.32-1not yet assignedNot reported[1136702]
Debianpython-multipartsourcetrixie(unfixed)not yet assignedNot reported[1136702]
Debianpython-multipartsourcebookworm(unfixed)not yet assignedNot reported[1136702]
PyPIpython-multipartPyPINot reported0.0.27Not reportedGHSA-PP6C-GR5W-3C5GNot reported
Opensusepython-python-multipartrpmtumbleweed0.0.28-1.1Not reportedOPENSUSE-SU-2026:10797-1Not reported

[Debian bug #1136702]

Notes

[trixie] python-multipart: Minor issue [bookworm] python-multipart: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-multipart]Affected

    Source package: [python-multipart]

    Details (2)

    • 0.0.5-3 · all · bookworm

      Affected

      nvd · python-multipart · debian · bookworm; nvd · python-multipart · debian · 12

    • 0.0.5-3 · all · bookworm

      Affected

      nvd · python-multipart · debian · bookworm; nvd · python-multipart · debian · 12

[Debian 13 (Trixie)]

  • [python3-python-multipart]Affected

    Source package: [python-multipart]

    Details (2)

    • 0.0.20-1.1~deb13u1 · all · trixie

      Affected

      nvd · python-multipart · debian · 13

    • 0.0.20-1.1~deb13u1 · all · trixie

      Affected

      nvd · python-multipart · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]