7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42561

CVE-2026-42561: Python-Multipart: Denial of Service via unbounded multipart part headers

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42561

CVE-2026-42561:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
python-multipart	pip	< 0.0.27	0.0.27

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in python-multipart caused by unbounded parsing of multipart part headers. The advisory states that the MultipartParser class previously had no limits on the number of headers or their size. The patch for this vulnerability, found in commit 3e64f5f8caba0e5d391b0c1ad0f1c2edf9e8f911, directly modifies the MultipartParser._internal_write method. This method implements the low-level state machine for parsing the multipart data stream. The patch adds new parameters, max_header_count and max_header_size, and integrates checks for these limits directly into the header processing logic within the _internal_write function's state machine. When the vulnerability is exploited, it is this _internal_write function that would be stuck in a CPU-intensive loop, processing the malicious headers. Therefore, MultipartParser._internal_write is the precise function that would appear in a runtime profile during an attack, and it is the function that contained the vulnerable logic.

Vulnerable functions

MultipartParser._internal_write

python_multipart/multipart.py

This function contains the core state machine for parsing multipart data. In vulnerable versions, it did not limit the number of headers or the size of each header it processed. An attacker could send a specially crafted multipart request with an excessive number of headers or an extremely large header value, causing this function to loop extensively and consume 100% CPU, leading to a denial of service. The vulnerable code path is within the header parsing states (`HEADER_FIELD_START`, `HEADER_FIELD`, `HEADER_VALUE_START`, `HEADER_VALUE`) of this function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.