5.3

CVE-2026-40347: fastapiexpert python-multipart Uncontrolled Resource Consumption

CVSS: 5.3v3.1MediumAnalyzed
AliasesGHSA-mj87-hwqh-73pjPYSEC-2026-3038UBUNTU-CVE-2026-40347
Published 17-04-2026Last modified 20-04-2026
Open JSON

Vulnerability summary

CVE-2026-40347 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in fastapiexpert python-multipart. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.7% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.42%
0%100%
Low · +0.07 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
SUSE-SU-2026:21999-1CGA-86PM-FP89-9WRV

Timeline

  1. 17-04-2026
    PublishedVulnerability first disclosed.
  2. 20-04-2026
    Last modifiedVulnerability information updated.

Description

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.42%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

+0.07 pp

From 0.35% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard15 products
  • airflow-2< 2.11.2-r9
  • airflow-3< 3.2.1-r0
  • airflow-core-2All versions (No fix recorded)
  • airflow-core-3< 3.2.1-r0
  • keep-api< 0.51.0-r4 | < 0.51.0-r3
Wolfi3 products
  • airflow-3< 3.2.1-r0
  • kserve-storage-controller< 0.17.0-r2
  • semgrep< 1.160.0-r1
Debian1 product
  • python-multipartAll versions (No fix recorded) | < 0.0.26-1
Fastapiexpert1 product
Kludex1 product
Opensuse1 product
  • python-python-multipart&distro=openSUSE Tumbleweed< 0.0.26-1.1
PyPI1 product
  • python-multipart< 0.0.26
Ubuntu1 product
  • python-multipartAll versions (No fix recorded)

8 vendors · 24 products

References

12 links
Show all 12 references