CVE-2026-40347

CYBERSECURITY BRIEFING NOTE OVERVIEW CVE-2026-40347 affects Python-Multipart, a streaming multipart parser library, in versions prior to 0.0.26. The vulnerability is a denial of service flaw triggered when processing crafted multipart/form-data requests containing large preamble or epilogue sections. This affects any application using vulnerable versions of the library to handle file uploads or form submissions. SEVERITY The vulnerability carries a CVSS v3.1 score of 5.3 (Medium), with an attack vector that is network-based, requires no authentication or user interaction, and results in low availability impact. Exploitation is straightforward, as attackers need only craft and transmit a specially-formed HTTP request. The attack causes denial of service by consuming excessive processing resources during parsing of the malformed multipart data, but does not enable data theft or system compromise. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on public threat tracking lists. The EPSS score of 0.00019 indicates minimal exploit probability relative to other CVEs. Remediation is straightforward through updating to version 0.0.26 or later, which implements efficient boundary-skipping logic to prevent the denial of service condition.