Hi,

The following vulnerability was published for python-multipart.

CVE-2026-42561[0]:
| Python-Multipart is a streaming multipart parser for Python. Prior
| to 0.0.27, python-multipart has a denial of service vulnerability in
| multipart part header parsing. When parsing multipart/form-data,
| MultipartParser previously had no limit on the number of part
| headers or the size of an individual part header. An attacker could
| send a request with either many repeated headers without terminating
| the header block or a single very large header value, causing
| excessive CPU work before request rejection or completion. This
| vulnerability is fixed in 0.0.27.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-42561
https://www.cve.org/CVERecord?id=CVE-2026-42561
[1] https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g
[2] https://github.com/Kludex/python-multipart/pull/267
[3] https://github.com/Kludex/python-multipart/commit/3e64f5f8caba0e5d391b0c1ad0f1c2edf9e8f911

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
python-multipart, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1136702@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sandro Tosi <morph@debian.org> (supplier of updated python-multipart package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 25 Sep 2026 03:16:51 -0400
Source: python-multipart
Architecture: source
Version: 0.0.32-1
Distribution: unstable
Urgency: medium
Maintainer: Sandro Tosi <morph@debian.org>
Changed-By: Sandro Tosi <morph@debian.org>
Closes: 1136702 1140628 1143451
Changes:
 python-multipart (0.0.32-1) unstable; urgency=medium
 .
   * New upstream release
     - fixes CVE-2026-42561; Closes: #1136702
     - fixes CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540;
       Closes: #1140628
   * debian/control
     - drop the transitional Provides on python3-multipart, it is now a real,
       API-incompatible package from src:multipart; Closes: #1143451
     - drop Breaks/Replaces on python3-multipart (<< 0.0.17-2), no longer
       needed after the trixie release
     - bump debhelper compat to 14, drop the now automatic substvars
     - explicitly activate the single-binary dh addon
     - drop Priority and Rules-Requires-Root, the defaults already
     - drop unneeded build-dependencies, mark test-only ones <!nocheck>
     - update Homepage to the new upstream location
     - bump Standards-Version to 4.7.4 (no changes needed)
   * debian/rules
     - let pybuild run the tests against the built module
   * debian/copyright
     - update upstream location and contact
     - remove stanza for files no longer shipped upstream
     - extend packaging copyright years
   * debian/watch
     - convert to version 5, track the new upstream location
   * debian/upstream/metadata
     - update to the new upstream location, add Changelog and Documentation
   * debian/patches/install-only-python_multipart.patch
     - add DEP-3 header, refresh
   * debian/source/options
     - remove, egg-info is no longer generated since the switch to hatchling
Checksums-Sha1:
 3e2d133ea68d77130bba0b7502b4304f78e62647 2130 python-multipart_0.0.32-1.dsc
 13cdbeeb7cbff7e08d642d24cfd3cfdfffdcab7a 109464 python-multipart_0.0.32.orig.tar.xz
 024489d42e62319a8c939d7d23024d1eacefade4 3040 python-multipart_0.0.32-1.debian.tar.xz
 cfd64fa7281c7ed2138293f3d0e928d72509ab0b 8051 python-multipart_0.0.32-1_source.buildinfo
Checksums-Sha256:
 363ae2b5807a3f2d8824b1cb9711ee6c58d65962e50f5145cc1dc5918125f2c3 2130 python-multipart_0.0.32-1.dsc
 d37d0d990a59290f236afda3dd89502998bf2cd314082859a673bed7756a1f1a 109464 python-multipart_0.0.32.orig.tar.xz
 ed95fc1aae9bedbf0f05edbf52b94410e1b31a870a63a5864214374f4782a1fb 3040 python-multipart_0.0.32-1.debian.tar.xz
 b97066e8e402f38f4a7a7a68f5420de927f44ae240f946a8cf49951cbf1bf932 8051 python-multipart_0.0.32-1_source.buildinfo
Files:
 215d8a01f2e1444cea60b8155629dbc2 2130 python optional python-multipart_0.0.32-1.dsc
 9b05a4de70e870a02e89b37d829e6abf 109464 python optional python-multipart_0.0.32.orig.tar.xz
 333d59a319e7cd85c23c8ad418159572 3040 python optional python-multipart_0.0.32-1.debian.tar.xz
 2f8cb6f934fef93411889b1643985c42 8051 python optional python-multipart_0.0.32-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEufrTGSrz5KUwnZ05h588mTgBqU8FAmq2H/UACgkQh588mTgB
qU+QUw/+I7Mb4CI4bp1FRSC18OAuSIyMiUsVm3Dxu4smJVd6eJGV+V9tt1VQPH/6
HKHLtzXSOiyFuIttLH5l+y64YeHVRCzD6jKmkv8SLF9Yb8AYCIjWcQ3T5gQ0NDLO
ZRy2ey2lqYSM2LDEuSlNcuK7r6QuR5kKF7bbRL5kvtYZsjKP+uXsxB2D1pArloyC
GedfO1eYM5Z5eaxR5ZCAgiGk8NFJXqtL/Ov2SWklQw4Ym28b5hd01CPqIXfIj3PK
CfyvOVri4dRgR2QW8BknpAXHLRYF6kVsfNZBSIE2v/5wJjaW/f/aUxpdVFv4A0jH
GdzKDXDUQhN4YbjZhOgLHrBdC9z76axZg4ySKtABWSVjnntO8INgbA0nXYlSSa6c
X/s9LwxP2SeSv+93tOFFrvOGGurfPbfxkWr+yNYmxSKpMTGurqnM5YtZiSax/jqy
BdGO/rYOlhelUw/EuuyH0l3s0SB3dZsCU8W7RqzjG8cSVXdlac9F2eMd8mX7xCGT
3iuP92sRj6VC/g0VTszpkhZmBvI2W6YIxTXLgyzZwFKQdDbdHaFY8KL7BS3Otf/+
wfu2WDJuHOQJnmlG4dI3zujkD//sp+fBPpI2Nj6+e2qis2gf4kcA4lZbxz2DihjJ
P186zKd5ujMg0GQqAB07czXYkvVT06tzEs8LsaY5n/XHPxcvCY8=
=PSZa
-----END PGP SIGNATURE-----