A negative Content-Length header causes the parse_form function in python-multipart to perform an unbounded read, loading the entire request body into memory in a single operation. This can lead to excessive memory consumption and a crash of the application or the host, resulting in a denial‑of‑service condition for the affected service.

The vulnerability applies to Kludex python‑multipart versions prior to 0.0.31. Any deployment using these earlier releases is susceptible; specific downstream frameworks that depend on this library without proper validation may also be impacted.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score is unavailable, suggesting limited public exploitation data. It is not listed in the CISA KEV catalog. The likely attack vector is through any HTTP request that includes a negative Content‑Length header, which could be crafted by an external attacker controlling the request. Exploitation would require the attacker to send such a request to a service using an affected library version, leading to memory exhaustion and service disruption.