CVE-2026-42561
EUVD-2026-3015913.05.2026, 21:16
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1783832856 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1783920640 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1783923914 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1783918403 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 | 1784109883 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782887848 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.17 | 1784834402 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.19 | 1785929994 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.19 | 1785806554 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-770 - Allocation of Resources Without Limits or ThrottlingThe software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
- CWE-606 - Unchecked Input for Loop ConditionThe product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
References