Python‑Multipart is a streaming multipart parser for Python that, before version 0.0.27, was vulnerable to a denial‑of‑service attack. The parser does not impose limits on the number of part headers or the size of an individual header when parsing multipart/form‑data, allowing an attacker to send a request with either many repeated headers or a single very large header value. This forces the parser to perform excessive CPU work before it can reject or complete the request, potentially exhausting server resources and disrupting availability.

The vulnerability affects installations of Kludex python‑multipart in any version earlier than 0.0.27. Clients or services that use this library to process multipart/form‑data should review the version they are running.

The CVSS score of 7.5 indicates a high impact with limited exploit requirements. Because the attack vector likely involves HTTP multipart requests, any exposed endpoint that accepts multipart/form‑data is a potential target, though the absence of an EPSS score and lack of listing in the CISA KEV catalog suggest the vulnerability is not yet widely exploited. Nevertheless, an attacker could craft a malicious request to trigger the denial‑of‑service condition if the target has not applied the fix.