CVE-2026-40347: Python-Multipart DOS Vulnerability

CVE-2026-40347 Overview

Python-Multipart is a streaming multipart parser for Python commonly used in web frameworks like FastAPI and Starlette. Versions prior to 0.0.26 contain a denial of service vulnerability that can be triggered when parsing crafted multipart/form-data requests containing large preamble or epilogue sections. This vulnerability allows remote attackers to exhaust server resources by sending malicious multipart requests, potentially causing service disruption for legitimate users.

Critical Impact

Remote attackers can cause denial of service by sending specially crafted multipart/form-data requests with oversized preamble or epilogue sections, leading to resource exhaustion and service unavailability.

Affected Products

• Python-Multipart versions prior to 0.0.26
• Web applications using vulnerable Python-Multipart versions for multipart parsing
• FastAPI and Starlette applications with vulnerable Python-Multipart dependencies

Discovery Timeline

• 2026-04-18 - CVE CVE-2026-40347 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40347

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw exists in how Python-Multipart processes multipart/form-data requests, specifically in the handling of preamble and epilogue sections. When a crafted request contains abnormally large preamble data (content before the first boundary) or epilogue data (content after the closing boundary), the parser inefficiently processes this data, consuming excessive CPU cycles and memory resources.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. While the impact is limited to availability (denial of service) without affecting confidentiality or integrity, it poses a significant risk to production environments where Python-Multipart is used for file uploads and form processing.

Root Cause

The root cause lies in the parser's inefficient handling of leading CR/LF (carriage return/line feed) data and epilogue content. Prior to the fix, the parser would process each byte of preamble data sequentially when searching for boundary markers, and would continue processing epilogue data after the closing boundary instead of immediately discarding it. This allowed attackers to force the parser into expensive processing loops by crafting requests with megabytes of preamble or epilogue content.

Attack Vector

An attacker can exploit this vulnerability by sending HTTP POST requests with multipart/form-data content type containing:

1. Large preamble sections: Excessive data placed before the first boundary marker
2. Large epilogue sections: Excessive data placed after the closing boundary marker
3. Malformed CR/LF sequences: Sequences designed to maximize processing overhead

The attack can be executed remotely over the network and requires no authentication, making it accessible to anonymous attackers targeting any exposed endpoint that processes multipart form data.

The vulnerability manifests in the boundary detection and content processing logic of the multipart parser. When processing incoming multipart data, the parser searches for boundary markers sequentially. Malicious requests exploit this by including large amounts of data before the first boundary (preamble) or after the final boundary (epilogue), forcing the parser to process unnecessary data. For detailed technical information, see the GitHub Security Advisory GHSA-mj87-hwqh-73pj.

Detection Methods for CVE-2026-40347

Indicators of Compromise

• Unusual spikes in CPU and memory usage on web servers processing multipart requests
• Abnormally large HTTP POST requests with multipart/form-data content type
• Web application timeouts or slow response times specifically on file upload endpoints
• Increased error rates or connection resets during form submission handling

Detection Strategies

• Monitor web server logs for POST requests with Content-Type: multipart/form-data and unusually large Content-Length headers
• Implement application performance monitoring (APM) to detect resource exhaustion patterns during multipart parsing
• Configure web application firewalls (WAF) to flag or block multipart requests exceeding reasonable size thresholds
• Use dependency scanning tools to identify Python-Multipart versions below 0.0.26 in your application dependencies

Monitoring Recommendations

• Set up alerts for sustained high CPU usage on application servers handling file uploads
• Monitor request duration metrics for endpoints that process multipart form data
• Track memory allocation patterns for processes handling multipart parsing
• Implement rate limiting on endpoints that accept multipart/form-data submissions

How to Mitigate CVE-2026-40347

Immediate Actions Required

• Upgrade Python-Multipart to version 0.0.26 or later immediately
• Review all applications using Python-Multipart and update their dependencies
• Implement request size limits at the web server or reverse proxy level as an additional safeguard
• Consider implementing rate limiting on file upload endpoints to reduce attack surface

Patch Information

The vulnerability has been addressed in Python-Multipart version 0.0.26. The fix implements two key improvements:

1. Optimized preamble handling: The parser now skips ahead to the next boundary candidate when processing leading CR/LF data, rather than processing each byte sequentially
2. Immediate epilogue discard: The parser immediately discards epilogue data after encountering the closing boundary, preventing resource consumption from trailing content

Upgrade using pip:

pip install python-multipart>=0.0.26

For more information, see the GitHub Release 0.0.26 and the GitHub Security Advisory GHSA-mj87-hwqh-73pj.

Workarounds

• Implement strict request size limits at the reverse proxy or web server level (e.g., nginx client_max_body_size)
• Configure timeouts for multipart request processing to prevent long-running parse operations
• Use a web application firewall to inspect and limit multipart request structure
• Implement rate limiting on endpoints that accept file uploads or form submissions

# Nginx configuration example for request size limits
# Add to server or location block
client_max_body_size 10m;
client_body_timeout 60s;