Medium severity5.3NVD Advisory· Published Apr 18, 2026· Updated Apr 24, 2026
CVE-2026-40347
CVE-2026-40347
Description
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
python-multipartPyPI | < 0.0.26 | 0.0.26 |
Affected products
22- cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:*Range: <0.0.26
- osv-coords21 versionspkg:apk/chainguard/airflow-2pkg:apk/chainguard/airflow-3pkg:apk/chainguard/airflow-core-3pkg:apk/chainguard/keep-apipkg:apk/chainguard/keep-api-fipspkg:apk/chainguard/kserve-storage-controllerpkg:apk/chainguard/litellmpkg:apk/chainguard/semgreppkg:apk/chainguard/synapsepkg:apk/chainguard/tritonserver-backend-vllm-cuda-12.9pkg:apk/chainguard/tritonserver-backend-vllm-cuda-13.0pkg:apk/chainguard/vllm-openai-cuda-12.9pkg:apk/chainguard/wazuh-manager-frameworkpkg:apk/chainguard/wazuh-manager-framework-fipspkg:apk/wolfi/airflow-3pkg:apk/wolfi/kserve-storage-controllerpkg:apk/wolfi/semgreppkg:pypi/python-multipartpkg:rpm/opensuse/python-python-multipart&distro=openSUSE%20Tumbleweedpkg:rpm/suse/python-python-multipart&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/python-python-multipart&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 2.11.2-r9+ 20 more
- (no CPE)range: < 2.11.2-r9
- (no CPE)range: < 3.2.1-r0
- (no CPE)range: < 3.2.1-r0
- (no CPE)range: < 0.51.0-r4
- (no CPE)range: < 0.51.0-r3
- (no CPE)range: < 0.17.0-r2
- (no CPE)range: < 1.82.3.0-r4
- (no CPE)range: < 1.160.0-r1
- (no CPE)range: < 1.151.0-r3
- (no CPE)range: < 25.9.0_git20260318-r1
- (no CPE)range: < 25.11-r4
- (no CPE)range: < 0.19.1-r0
- (no CPE)range: < 4.14.4-r5
- (no CPE)range: < 4.14.5-r0
- (no CPE)range: < 3.2.1-r0
- (no CPE)range: < 0.17.0-r2
- (no CPE)range: < 1.160.0-r1
- (no CPE)range: < 0.0.26
- (no CPE)range: < 0.0.26-1.1
- (no CPE)range: < 0.0.20-160000.4.1
- (no CPE)range: < 0.0.20-160000.4.1
Patches
Vulnerability mechanics
References
4- github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pjnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-mj87-hwqh-73pjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40347ghsaADVISORY
- github.com/Kludex/python-multipart/releases/tag/0.0.26nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.