Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20846-1

Опубликовано: 29 мая 2026
Источник: suse-cvrf

Описание

Security update for python-python-multipart

This update for python-python-multipart fixes the following issues

  • CVE-2026-40347: crafted multipart/form-data can cause a denial of service (bsc#1262403).
  • CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).

Список пакетов

openSUSE Leap 16.0
python313-python-multipart-0.0.20-160000.4.1

Ссылки

Описание

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.

Затронутые продукты
openSUSE Leap 16.0:python313-python-multipart-0.0.20-160000.4.1
Ссылки

Описание

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

Затронутые продукты
openSUSE Leap 16.0:python313-python-multipart-0.0.20-160000.4.1
Ссылки