CVE-2026-42561 Details

A denial-of-service vulnerability has been identified in Python-Multipart versions prior to 0.0.27. The issue arises in the multipart part header parsing of the library, which is a streaming multipart parser for Python. The vulnerability allows an attacker to cause excessive CPU usage by sending requests with many repeated headers that do not terminate the header block, or by including a single very large header value. This unbounded header parsing can lead to significant performance degradation before the request is either rejected or completed.

Users are advised to upgrade to Python-Multipart version 0.0.27 or later. If an immediate upgrade is not possible, request body size limits can be enforced at the server, proxy, or framework level to mitigate exposure, although this does not fully address the vulnerability.