CVE-2026-40347

Description

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.

PUBLISHED Reserved 2026-04-10 | Published 2026-04-17 | Updated 2026-04-20 | Assigner GitHub_M

Problem types

CWE-400: Uncontrolled Resource Consumption

CWE-834: Excessive Iteration

Product status

References

github.com/...tipart/security/advisories/GHSA-mj87-hwqh-73pj

github.com/Kludex/python-multipart/releases/tag/0.0.26

cve.org (CVE-2026-40347)

nvd.nist.gov (CVE-2026-40347)

Download JSON