CVE-2026-42561

Fixed in a distro release EPSS <1%CVSS 7.5

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

Published 2026-05-13 · CVE record · OSV

Products: Kludex python-multipart, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 3.3, Red Hat Satellite 6.17, Red Hat Satellite 6.19, Red Hat Exploit Intelligence, Red Hat OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6

Fixed upstream

Distro releases