GHSA-mj87-hwqh-73pj

Suggest an improvement
Source
https://github.com/advisories/GHSA-mj87-hwqh-73pj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mj87-hwqh-73pj/GHSA-mj87-hwqh-73pj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mj87-hwqh-73pj
Aliases
  • CVE-2026-40347
Downstream
Related
Published
2026-04-15T19:45:44Z
Modified
2026-04-17T00:30:15.248451496Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Details

Summary

A denial of service vulnerability exists when parsing crafted multipart/form-data requests with large preamble or epilogue sections.

Details

Two inefficient multipart parsing paths could be abused with attacker-controlled input.

Before the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.

Impact

An attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.

Mitigation

Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.

Database specific 
{
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-400",
        "CWE-834"
    ],
    "github_reviewed_at": "2026-04-15T19:45:44Z"
}
References

Affected packages

PyPI / python-multipart

Package

Name
python-multipart
View open source insights on deps.dev
Purl
pkg:pypi/python-multipart

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.0.26

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mj87-hwqh-73pj/GHSA-mj87-hwqh-73pj.json"