Python-Multipart is a streaming multipart parser used in Python web applications. The vulnerability allows an attacker to create a multipart/form‑data request that contains a very large preamble or epilogue section. When parsed, the library consumes excessive resources before reaching the actual file data, potentially exhausting server memory or CPU and causing service interruption. The weakness is characterized by a failure to enforce resource limits (CWE‑1050), a denial‑of‑service via resource consumption (CWE‑400), and improper handling of input data (CWE‑834).

The issue affects the Kludex Python‑Multipart package, specifically all releases older than 0.0.26. Systems that rely on this package to process file uploads or form submissions are potentially exposed if they accept large multipart boundaries without appropriate size controls.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of < 1% suggests a very low but non‑zero exploitation probability, and the absence from the CISA KEV catalog indicates no public exploits are documented. Likely attack vectors involve a client sending a crafted HTTP request to a vulnerable server; no authentication or additional privileges are required. The weakness involves a failure to enforce resource limits (CWE‑1050) and excessive resource consumption (CWE‑400) due to large preamble or epilogue data, limiting the impact to service availability but potentially affecting broader infrastructure reliability through repeated or high‑volume attacks.