The vulnerability CVE-2026-42561 affects the python-multipart component used in Red Hat Lightspeed within Red Hat Satellite. It allows a remote attacker to cause a denial of service by sending multipart/form-data requests with an excessive number of part headers or a single very large header value. This triggers excessive CPU consumption during multipart parsing, leading to service disruption. The vulnerability is categorized under CWE-606 (Unchecked Input for Loop Condition). Red Hat has published an advisory (RHSA-2026:51219) describing the issue and providing references but has not released a patch or fix for this vulnerability yet. The advisory notes that this is an important security issue with a CVSS v3 base score of 7.5 (high severity) as assessed by Red Hat. The vulnerability affects Red Hat Satellite and related container images available as Technology Preview. No known exploits in the wild have been reported. The vendor advisory emphasizes that remediation status is under investigation and that customers should consult Red Hat documentation for configuration guidance.

A remote attacker can exploit this vulnerability to cause a denial of service by triggering excessive CPU utilization on systems running Red Hat Lightspeed in Satellite. This can disrupt service availability by exhausting system resources during multipart/form-data request parsing. There is no impact on confidentiality or integrity reported. The impact is limited to availability degradation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat has not released an official fix for this vulnerability as of the advisory date. Users should monitor Red Hat's errata and security advisories for updates. In the meantime, consider limiting exposure of the affected service to untrusted networks or applying any configuration recommendations from Red Hat Satellite documentation related to Red Hat Lightspeed. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for tailored guidance. No vendor-stated mitigations or workarounds are currently documented.