CVE-2026-40347: 
Python vulnerability analysis and mitigation

CVE-2026-40347 is a Denial of Service (DoS) vulnerability in python-multipart, a streaming multipart parser for Python. It affects all versions prior to 0.0.26 and was published on April 14–15, 2026 by the library maintainer (Kludex) via a GitHub Security Advisory. The vulnerability allows unauthenticated remote attackers to cause excessive CPU consumption by sending crafted multipart/form-data requests with oversized preamble or epilogue sections. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled resource consumption (CWE-400) stemming from excessive iteration (CWE-834, CWE-1050) in two distinct parsing paths. First, before the first multipart boundary, the parser processed leading CR (\r) and LF (\n) bytes one at a time in an inefficient loop while searching for the start of the first part. Second, after the closing boundary, the parser continued iterating over trailing epilogue data rather than discarding it immediately. Both paths allow parsing time to grow linearly — or worse — with attacker-controlled input size, enabling CPU exhaustion without authentication or special privileges (GitHub Advisory, python-multipart Advisory).

Successful exploitation degrades the availability of any Python web application that uses python-multipart to parse file uploads or form data (e.g., FastAPI, Starlette-based services). Crafted requests consume excessive CPU time during parsing, reducing the server's request-handling capacity and delaying responses to legitimate users. The vulnerability does not affect confidentiality or integrity, and a complete application-level denial of service is not guaranteed, but sustained attack traffic can significantly impair service responsiveness (GitHub Advisory). Downstream products confirmed affected include IBM App Connect Enterprise Certified Container and IBM watsonx Orchestrate Developer Edition, as well as OpenVPN Access Server prior to 3.2.0 (OpenVPN Release Notes, IBM Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-40347. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044% (roughly the 6th percentile), indicating a low probability of exploitation in the near term. However, the attack requires no authentication, no user interaction, and low complexity, making it straightforward to attempt against any exposed endpoint that accepts multipart form data (GitHub Advisory).

1. Reconnaissance: Identify web applications using python-multipart versions prior to 0.0.26 — commonly FastAPI or Starlette-based services — by probing endpoints that accept multipart/form-data (e.g., file upload endpoints).
2. Craft malicious request: Construct an HTTP POST request with Content-Type: multipart/form-data; boundary=boundary_string. Insert a very large block of CR/LF bytes (e.g., megabytes of \r\n sequences) before the first --boundary_string line to abuse the preamble parsing path.
3. Alternatively, abuse epilogue: Place a very large block of arbitrary data after the closing boundary (--boundary_string--) to trigger the inefficient epilogue processing path.
4. Send repeated requests: Transmit the crafted request(s) repeatedly to the target endpoint. Each request forces the server to spend disproportionate CPU time parsing the oversized preamble or epilogue, degrading throughput for legitimate users.
5. Observe impact: Monitor for increased server response latency or request queue buildup, indicating successful resource exhaustion (GitHub Advisory, python-multipart Advisory).

• Network: Unusually large HTTP POST requests to file upload or form submission endpoints with Content-Type: multipart/form-data; requests with bodies significantly larger than expected application limits, particularly with large amounts of data before the first boundary or after the closing boundary.
• Logs: Web server or application logs showing repeated POST requests to multipart-accepting endpoints from the same or rotating source IPs; abnormally long request processing times logged for multipart endpoints.
• Process/System: Sustained high CPU utilization on the web application process (e.g., Python/uvicorn/gunicorn worker) without a corresponding spike in legitimate traffic; increased request queue depth or worker thread exhaustion in application performance monitoring.

The primary remediation is to upgrade python-multipart to version 0.0.26 or later, which fixes both vulnerable parsing paths by skipping ahead to the next boundary candidate when processing leading CR/LF data and immediately discarding epilogue data after the closing boundary (python-multipart Release). Downstream users of affected products should apply vendor-specific patches: OpenVPN Access Server users should upgrade to version 3.2.0 (OpenVPN Release Notes), and IBM product users should refer to the relevant IBM security bulletins (IBM Advisory). As a temporary workaround where patching is not immediately possible, consider enforcing strict request body size limits at the reverse proxy or web server layer (e.g., client_max_body_size in Nginx) to limit the size of multipart payloads that reach the application.

Red Hat tracked the vulnerability via Bugzilla (Bug 2459381) with medium priority and severity, and it was picked up by openSUSE security announcements and Linux security news outlets (Red Hat Bugzilla). The vulnerability was credited to reporter HamdaanAliQuatil and analyst defnull in the GitHub Advisory. No significant social media controversy or high-profile researcher commentary has been observed, consistent with the moderate severity rating.