CVE-2026-40347 Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
Attackers can cause denial of service in applications using Python-Multipart by sending crafted requests with large preamble or epilogue data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40347?
CVE-2026-40347 is a medium-severity denial of service vulnerability in Kludex python-multipart, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
Which versions are affected by CVE-2026-40347?
3 open source packages ship an affected version, including python-multipart. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-multipart PyPI | All versions | 0.0.26 |
python-multipart PyPI | All versions | 0.0.26 |
python-multipart PyPI | All versions | 0.0.26 |
Linux distribution packages (1)
python-python-multipart openSUSE:Tumbleweed | All versions | 0.0.26-1.1 |
Products include Fastapiexpert Python-Multipart.
How do I fix CVE-2026-40347?
Upgrade python-multipart to 0.0.26 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40347 being exploited?
There is no known exploitation of CVE-2026-40347 in the wild and no public exploit code.
Other vulnerabilities in Kludex python-multipart
- CVE-2026-24486 Python-Multipart has Arbitrary File Write via Non-Default Configuration
- CVE-2026-53539 Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
- CVE-2024-24762 python-multipart vulnerable to content-type header Regular expression Denial of Service
- CVE-2026-53537 Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
- CVE-2026-53538 Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling
Sources
Also known as CLEANSTART-2026-IO67375, CLEANSTART-2026-VJ88910, CLSA-2026-1781571262, DEBIAN-CVE-2026-40347, ECHO-93a8-8bc8-dfad, GHSA-mj87-hwqh-73pj and 10 more.