CVE-2026-40347
Fixed in a distro release EPSS <1%CVSS 5.3
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
Products: Kludex python-multipart
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | python-multipart | 0.0.26 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.2-r9 |
| Chainguard | airflow-3 | 3.2.1-r0 |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | airflow-core-3 | 3.2.1-r0 |
| Chainguard | keep-api | 0.51.0-r3 |
| Chainguard | keep-api | 0.51.0-r4 |
| Chainguard | keep-api-fips | 0.51.0-r3 |
| Chainguard | kserve-storage-controller | 0.17.0-r2 |
| Chainguard | litellm | 1.82.3.0-r4 |
| Chainguard | semgrep | 1.160.0-r1 |
| Chainguard | synapse | 1.151.0-r3 |
| Chainguard | tritonserver-backend-vllm-cuda-12.9 | 25.9.0_git20260318-r1 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r4 |
| Chainguard | vllm-openai-cuda-12.9 | 0.19.1-r0 |
| Chainguard | wazuh-manager-framework | 4.14.4-r5 |
| Chainguard | wazuh-manager-framework-fips | 4.14.5-r0 |
| Debian 12 | python-multipart | no fix |
| Debian 13 | python-multipart | no fix |
| Debian 14 | python-multipart | 0.0.26-1 |
| SUSE Linux Enterprise Server 16.0 | python-python-multipart | 0.0.20-160000.4.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-python-multipart | 0.0.20-160000.4.1 |
| Ubuntu 25.10 | python-multipart | no fix |
| Ubuntu 26.04 LTS | python-multipart | no fix |
| Ubuntu 26.10 | python-multipart | no fix |
| Ubuntu Pro 22.04 LTS | python-multipart | no fix |
| Ubuntu Pro 24.04 LTS | python-multipart | no fix |
| Wolfi | airflow-3 | 3.2.1-r0 |
| Wolfi | kserve-storage-controller | 0.17.0-r2 |
| Wolfi | semgrep | 1.160.0-r1 |
| openSUSE Tumbleweed | python-python-multipart | 0.0.26-1.1 |