CVE-2026-42561: CWE-770: Allocation of Resources Without Limits or Throttling in Kludex python-multipart
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
AI Analysis
Technical Summary
Python-Multipart versions before 0.0.27 contain a denial of service vulnerability (CWE-770) due to allocation of resources without limits or throttling in multipart part header parsing. Specifically, MultipartParser did not limit the number or size of part headers, allowing an attacker to craft multipart/form-data requests with excessive headers or very large header values. This leads to excessive CPU usage, resulting in denial of service. The vulnerability is tracked as CVE-2026-42561 with a CVSS v3.1 score of 7.5 (high severity). The issue is fixed in python-multipart version 0.0.27.
Potential Impact
Exploitation of this vulnerability allows a remote attacker to cause excessive CPU utilization on the affected system by sending specially crafted multipart/form-data requests. This results in denial of service due to resource exhaustion. There is no impact on confidentiality or integrity.
Mitigation Recommendations
A fix is available in python-multipart version 0.0.27. Users should upgrade to version 0.0.27 or later to remediate this vulnerability. No additional mitigations are specified by the vendor advisory.
CVE-2026-42561: CWE-770: Allocation of Resources Without Limits or Throttling in Kludex python-multipart
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.
CVSS v3.1
Score 7.5high
Affected software
Kludex
python-multipart
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Python-Multipart versions before 0.0.27 contain a denial of service vulnerability (CWE-770) due to allocation of resources without limits or throttling in multipart part header parsing. Specifically, MultipartParser did not limit the number or size of part headers, allowing an attacker to craft multipart/form-data requests with excessive headers or very large header values. This leads to excessive CPU usage, resulting in denial of service. The vulnerability is tracked as CVE-2026-42561 with a CVSS v3.1 score of 7.5 (high severity). The issue is fixed in python-multipart version 0.0.27.
Potential Impact
Exploitation of this vulnerability allows a remote attacker to cause excessive CPU utilization on the affected system by sending specially crafted multipart/form-data requests. This results in denial of service due to resource exhaustion. There is no impact on confidentiality or integrity.
Mitigation Recommendations
A fix is available in python-multipart version 0.0.27. Users should upgrade to version 0.0.27 or later to remediate this vulnerability. No additional mitigations are specified by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-28T16:56:50.192Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-42561","vendor":"Red Hat"}]
Threat ID: 6a04e7d1cbff5d86100a84f7
Added to database: 05/13/2026, 21:06:25 UTC
Last enriched: 08/07/2026, 12:58:20 UTC
Last updated: 09/14/2026, 05:10:36 UTC
Views: 115
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.