CVE-2026-42561: CWE-770: Allocation of Resources Without Limits or Throttling in Kludex python-multipart
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
AI Analysis
Technical Summary
The python-multipart library, used for streaming multipart parsing in Python, had a vulnerability (CVE-2026-42561) classified under CWE-770: Allocation of Resources Without Limits or Throttling. Before version 0.0.27, the MultipartParser did not impose limits on the number or size of part headers in multipart/form-data requests. This allowed attackers to craft requests with many repeated headers or a single large header value, leading to excessive CPU consumption and denial of service. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) and is addressed by updating to version 0.0.27 or later. The Red Hat advisory confirms the issue and references fixes in related products that bundle this library.
Potential Impact
Exploitation of this vulnerability can cause denial of service by exhausting CPU resources during multipart header parsing. There is no impact on confidentiality or integrity, but availability is severely affected due to excessive processing time triggered by maliciously crafted multipart requests.
Mitigation Recommendations
A fix is available in python-multipart version 0.0.27. Users should upgrade to version 0.0.27 or later to remediate this vulnerability. The Red Hat advisory also provides updated packages that include this fix. No other mitigation is indicated or required by the vendor advisory.
CVE-2026-42561: CWE-770: Allocation of Resources Without Limits or Throttling in Kludex python-multipart
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The python-multipart library, used for streaming multipart parsing in Python, had a vulnerability (CVE-2026-42561) classified under CWE-770: Allocation of Resources Without Limits or Throttling. Before version 0.0.27, the MultipartParser did not impose limits on the number or size of part headers in multipart/form-data requests. This allowed attackers to craft requests with many repeated headers or a single large header value, leading to excessive CPU consumption and denial of service. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) and is addressed by updating to version 0.0.27 or later. The Red Hat advisory confirms the issue and references fixes in related products that bundle this library.
Potential Impact
Exploitation of this vulnerability can cause denial of service by exhausting CPU resources during multipart header parsing. There is no impact on confidentiality or integrity, but availability is severely affected due to excessive processing time triggered by maliciously crafted multipart requests.
Mitigation Recommendations
A fix is available in python-multipart version 0.0.27. Users should upgrade to version 0.0.27 or later to remediate this vulnerability. The Red Hat advisory also provides updated packages that include this fix. No other mitigation is indicated or required by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-28T16:56:50.192Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-42561","vendor":"Red Hat"}]
Threat ID: 6a04e7d1cbff5d86100a84f7
Added to database: 05/13/2026, 21:06:25 UTC
Last enriched: 07/30/2026, 03:46:36 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.