--- id: CVE-2026-42561 title: >- python-multipart: python-multipart: Denial of Service via excessive multipart part headers (CVE-2026-42561) summary: >- A flaw was found in python-multipart. A remote attacker can exploit this denial of service (DoS) vulnerability by sending a specially crafted request with an excessive number of part headers or a single very large header value during multi… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-606 vendor: Red Hat product: Red Hat Enterprise Linux AI (RHEL AI) 3 affected: - exploit_intelligence - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - satellite 6 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - migration_toolkit_for_applications 8.2 - openshift_ai 3.3 - satellite 6.17 - satellite 6.18 - satellite 6.19 patched: - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - migration_toolkit_for_applications 8.2 - openshift_ai 3.3 - satellite 6.17 - satellite 6.18 - satellite 6.19 published: '2026-05-13' updated: '2026-10-15' sourceUpdated: '2026-10-15T11:01:29+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42561.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42561.json - url: 'https://access.redhat.com/security/cve/CVE-2026-42561' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2477309' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42561' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42561' - url: >- https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g - url: 'https://access.redhat.com/errata/RHSA-2026:42132' - url: 'https://access.redhat.com/errata/RHSA-2026:42142' - url: 'https://access.redhat.com/errata/RHSA-2026:43038' - url: 'https://access.redhat.com/errata/RHSA-2026:37275' - url: 'https://access.redhat.com/errata/RHSA-2026:44696' - url: 'https://access.redhat.com/errata/RHSA-2026:51357' - url: 'https://access.redhat.com/errata/RHSA-2026:51194' - url: 'https://access.redhat.com/errata/RHSA-2026:51219' - url: 'https://github.com/Kludex/python-multipart' tags: - csaf - vex - red-hat - osv - pip epss: 0.0074 epssPercentile: 0.54417 aliases: - GHSA-pp6c-gr5w-3c5g - PYSEC-2026-3039 ecosystem: pip ingestedAt: '2026-07-13T18:58:01.583Z' --- ## Overview A flaw was found in python-multipart. A remote attacker can exploit this denial of service (DoS) vulnerability by sending a specially crafted request with an excessive number of part headers or a single very large header value during multipart/form-data parsing. This can lead to excessive CPU utilization, resulting in a denial of service for the affected system. ## Vendor advisories - **RHSA-2026:42132** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42132) - **RHSA-2026:42142** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42142) - **RHSA-2026:43038** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43038) - **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275) - **RHSA-2026:44696** · Red Hat · fixed in: Red Hat Satellite 6.17 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44696) - **RHSA-2026:51357** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51357) - **RHSA-2026:51194** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51194) - **RHSA-2026:51219** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51219) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6 · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42561.json) **python-multipart: python-multipart: Denial of Service via excessive multipart part headers** — rated Important by Red Hat. Released 2026-05-13, updated 2026-10-15. Affected: - Exploit Intelligence - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Fixed: - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat Migration Toolkit for Applications 8.2 - Red Hat OpenShift AI 3.3 - Red Hat Satellite 6.17 - Red Hat Satellite 6.18 - Red Hat Satellite 6.19 No fix planned: - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Exploit Intelligence - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Not affected: - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat Migration Toolkit for Applications 8.2 - Red Hat OpenShift AI 3.3 - OpenShift Lightspeed - Red Hat AI Inference Server - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:42132 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade https://access.redhat.com/errata/RHSA-2026:42142 Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:43038 ## Package advisory (CVE-2026-42561) Affected packages: - `python-multipart < 0.0.27` Patched in: - `python-multipart 0.0.27` Source: https://osv.dev/vulnerability/GHSA-pp6c-gr5w-3c5g