Python-Multipart is a streaming multipart parser used in Python web applications. The vulnerability allows an attacker to create a multipart/form‑data request that contains a very large preamble or epilogue section. When parsed, the library consumes excessive resources before reaching the actual file data, potentially exhausting server memory or CPU and causing service interruption. The weakness is a resource limit bypass, matching CWE‑400 and an improper handling of input data, CWE‑834.

The issue affects the Kludex Python-Multipart package, specifically all releases older than 0.0.26. Systems that rely on this package to process file uploads or form submissions are potentially exposed if they accept large multipart boundaries without appropriate size controls.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, so the current exploit probability is unknown, but the absence from the CISA KEV catalog suggests no public exploits are documented. Likely attack vectors involve a client sending a crafted HTTP request to a vulnerable server; no authentication or additional privileges are required. The impact is limited to service availability for the affected application, but repeated or high‑volume attacks could affect broader infrastructure reliability.