Your message dated Fri, 25 Sep 2026 07:34:49 +0000
with message-id <[email protected]>
and subject line Bug#1136702: fixed in python-multipart 0.0.32-1
has caused the Debian Bug report #1136702,
regarding python-multipart: CVE-2026-42561
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1136702: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136702
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: python-multipart
Version: 0.0.26-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Kludex/python-multipart/pull/267
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for python-multipart.
CVE-2026-42561[0]:
| Python-Multipart is a streaming multipart parser for Python. Prior
| to 0.0.27, python-multipart has a denial of service vulnerability in
| multipart part header parsing. When parsing multipart/form-data,
| MultipartParser previously had no limit on the number of part
| headers or the size of an individual part header. An attacker could
| send a request with either many repeated headers without terminating
| the header block or a single very large header value, causing
| excessive CPU work before request rejection or completion. This
| vulnerability is fixed in 0.0.27.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-42561
https://www.cve.org/CVERecord?id=CVE-2026-42561
[1]
https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g
[2] https://github.com/Kludex/python-multipart/pull/267
[3]
https://github.com/Kludex/python-multipart/commit/3e64f5f8caba0e5d391b0c1ad0f1c2edf9e8f911
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: python-multipart
Source-Version: 0.0.32-1
Done: Sandro Tosi <[email protected]>
We believe that the bug you reported is fixed in the latest version of
python-multipart, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sandro Tosi <[email protected]> (supplier of updated python-multipart package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 25 Sep 2026 03:16:51 -0400
Source: python-multipart
Architecture: source
Version: 0.0.32-1
Distribution: unstable
Urgency: medium
Maintainer: Sandro Tosi <[email protected]>
Changed-By: Sandro Tosi <[email protected]>
Closes: 1136702 1140628 1143451
Changes:
python-multipart (0.0.32-1) unstable; urgency=medium
.
* New upstream release
- fixes CVE-2026-42561; Closes: #1136702
- fixes CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540;
Closes: #1140628
* debian/control
- drop the transitional Provides on python3-multipart, it is now a real,
API-incompatible package from src:multipart; Closes: #1143451
- drop Breaks/Replaces on python3-multipart (<< 0.0.17-2), no longer
needed after the trixie release
- bump debhelper compat to 14, drop the now automatic substvars
- explicitly activate the single-binary dh addon
- drop Priority and Rules-Requires-Root, the defaults already
- drop unneeded build-dependencies, mark test-only ones <!nocheck>
- update Homepage to the new upstream location
- bump Standards-Version to 4.7.4 (no changes needed)
* debian/rules
- let pybuild run the tests against the built module
* debian/copyright
- update upstream location and contact
- remove stanza for files no longer shipped upstream
- extend packaging copyright years
* debian/watch
- convert to version 5, track the new upstream location
* debian/upstream/metadata
- update to the new upstream location, add Changelog and Documentation
* debian/patches/install-only-python_multipart.patch
- add DEP-3 header, refresh
* debian/source/options
- remove, egg-info is no longer generated since the switch to hatchling
Checksums-Sha1:
3e2d133ea68d77130bba0b7502b4304f78e62647 2130 python-multipart_0.0.32-1.dsc
13cdbeeb7cbff7e08d642d24cfd3cfdfffdcab7a 109464
python-multipart_0.0.32.orig.tar.xz
024489d42e62319a8c939d7d23024d1eacefade4 3040
python-multipart_0.0.32-1.debian.tar.xz
cfd64fa7281c7ed2138293f3d0e928d72509ab0b 8051
python-multipart_0.0.32-1_source.buildinfo
Checksums-Sha256:
363ae2b5807a3f2d8824b1cb9711ee6c58d65962e50f5145cc1dc5918125f2c3 2130
python-multipart_0.0.32-1.dsc
d37d0d990a59290f236afda3dd89502998bf2cd314082859a673bed7756a1f1a 109464
python-multipart_0.0.32.orig.tar.xz
ed95fc1aae9bedbf0f05edbf52b94410e1b31a870a63a5864214374f4782a1fb 3040
python-multipart_0.0.32-1.debian.tar.xz
b97066e8e402f38f4a7a7a68f5420de927f44ae240f946a8cf49951cbf1bf932 8051
python-multipart_0.0.32-1_source.buildinfo
Files:
215d8a01f2e1444cea60b8155629dbc2 2130 python optional
python-multipart_0.0.32-1.dsc
9b05a4de70e870a02e89b37d829e6abf 109464 python optional
python-multipart_0.0.32.orig.tar.xz
333d59a319e7cd85c23c8ad418159572 3040 python optional
python-multipart_0.0.32-1.debian.tar.xz
2f8cb6f934fef93411889b1643985c42 8051 python optional
python-multipart_0.0.32-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEufrTGSrz5KUwnZ05h588mTgBqU8FAmq2H/UACgkQh588mTgB
qU+QUw/+I7Mb4CI4bp1FRSC18OAuSIyMiUsVm3Dxu4smJVd6eJGV+V9tt1VQPH/6
HKHLtzXSOiyFuIttLH5l+y64YeHVRCzD6jKmkv8SLF9Yb8AYCIjWcQ3T5gQ0NDLO
ZRy2ey2lqYSM2LDEuSlNcuK7r6QuR5kKF7bbRL5kvtYZsjKP+uXsxB2D1pArloyC
GedfO1eYM5Z5eaxR5ZCAgiGk8NFJXqtL/Ov2SWklQw4Ym28b5hd01CPqIXfIj3PK
CfyvOVri4dRgR2QW8BknpAXHLRYF6kVsfNZBSIE2v/5wJjaW/f/aUxpdVFv4A0jH
GdzKDXDUQhN4YbjZhOgLHrBdC9z76axZg4ySKtABWSVjnntO8INgbA0nXYlSSa6c
X/s9LwxP2SeSv+93tOFFrvOGGurfPbfxkWr+yNYmxSKpMTGurqnM5YtZiSax/jqy
BdGO/rYOlhelUw/EuuyH0l3s0SB3dZsCU8W7RqzjG8cSVXdlac9F2eMd8mX7xCGT
3iuP92sRj6VC/g0VTszpkhZmBvI2W6YIxTXLgyzZwFKQdDbdHaFY8KL7BS3Otf/+
wfu2WDJuHOQJnmlG4dI3zujkD//sp+fBPpI2Nj6+e2qis2gf4kcA4lZbxz2DihjJ
P186zKd5ujMg0GQqAB07czXYkvVT06tzEs8LsaY5n/XHPxcvCY8=
=PSZa
-----END PGP SIGNATURE-----
pgpyyetX7OfG6.pgp
Description: PGP signature
--- End Message ---
