CVE-2026-40347 Details
Description
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
A denial-of-service vulnerability has been identified in Python-Multipart, a streaming multipart parser for Python. This issue affects versions prior to 0.0.26 and arises when the parser processes crafted 'multipart/form-data' requests containing large preamble or epilogue sections. The vulnerability allows for excessive CPU consumption during request parsing, which can degrade the application's availability by slowing down the handling of legitimate requests.
Users are advised to upgrade to version 0.0.26 or later, which addresses the vulnerability by improving how the parser handles leading CR/LF data and by discarding epilogue data immediately after the closing boundary.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kludex/python-multipart/releases/tag/0.0.26 | [email protected] | ProductRelease Notes |
| https://github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-834 | Excessive Iteration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastapiexpert python-multipart | < 0.0.26 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 18, 2026 | New CVE Received | [email protected] |