StackRadar

CVE-2026-42561

High

Advisory

Published 6 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
58
of 17,781 indexed, latest versions
Container images
64
deployed by those charts
Fix available
1 of 1
affected package

python-multipart has Denial of Service via unbounded multipart part headers

Carried by container images the latest versions of 58 of 17,781 indexed charts deploy, on 64 images.

Affected packageAffected versionsFixed inImages
python-multipartpypi0.0.5, 0.0.6, 0.0.9, 0.0.18+6 more0.0.2764
OSV records
GHSA-pp6c-gr5w-3c5g
Also known as
PYSEC-2026-3039

Charts affected

58 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
python-multipart@0.0.20
0.0.27

Open the chart page →

11,384
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
python-multipart@0.0.9
0.0.27

Open the chart page →

6,543
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
python-multipart@0.0.20
0.0.27

Open the chart page →

17,245
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
python-multipart@0.0.9
0.0.27

Open the chart page →

6,168
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
python-multipart@0.0.5
0.0.27

Open the chart page →

7,579
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
python-multipart@0.0.22
0.0.27

Open the chart page →

4,634
klancesklances0.1.41 of 1See more

klances klances 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
python-multipart@0.0.22
0.0.27

Open the chart page →

1,693
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
python-multipart@0.0.20
0.0.27

Open the chart page →

3,804
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
python-multipart@0.0.6
0.0.27

Open the chart page →

17,877
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
python-multipart@0.0.6
0.0.27

Open the chart page →

1,944
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
python-multipart@0.0.20
0.0.27

Open the chart page →

5,274
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
python-multipart@0.0.9
0.0.27

Open the chart page →

16,514
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
python-multipart@0.0.20
0.0.27

Open the chart page →

15,712
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
python-multipart@0.0.20
0.0.27

Open the chart page →

3,421
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
python-multipart@0.0.26
0.0.27

Open the chart page →

1,678
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
python-multipart@0.0.9
0.0.27

Open the chart page →

20,403
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
python-multipart@0.0.18
0.0.27

Open the chart page →

4,292
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
python-multipart@0.0.6
0.0.27
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
python-multipart@0.0.6
0.0.27
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
python-multipart@0.0.6
0.0.27

Open the chart page →

37,373
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
python-multipart@0.0.20
0.0.27

Open the chart page →

3,929
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
python-multipart@0.0.19
0.0.27

Open the chart page →

11,532
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
python-multipart@0.0.22
0.0.27

Open the chart page →

5,558
flrepositorydbassist-iot-fl-repository1.1.01 of 2See more

flrepositorydb assist-iot-fl-repository 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
assistiot/fl_repository:latest0fce3ea719a5
python-multipart@0.0.5
0.0.27

Open the chart page →

4,367
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
python-multipart@0.0.6
0.0.27

Open the chart page →

18,277
pbcore-utilcluster-deploy0.0.11 of 1See more

pbcore-util cluster-deploy 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
python-multipart@0.0.20
0.0.27

Open the chart page →

9,128
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
python-multipart@0.0.20
0.0.27
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
python-multipart@0.0.21
0.0.27

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
python-multipart@0.0.20
0.0.27

Open the chart page →

11,335
helpdeskdoubanVerified publisher0.3.31 of 2See more

helpdesk douban 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
douz/helpdesk:latest4384103d0219
python-multipart@0.0.5
0.0.27

Open the chart page →

4,550
aerios-k8s-shimeclipse-aeriosVerified publisher1.0.01 of 1See more

aerios-k8s-shim eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
eclipseaerios/aerios-k8s-shim:v1.0.0d4ed3d8e5db4
python-multipart@0.0.9
0.0.27

Open the chart page →

1,434
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
python-multipart@0.0.20
0.0.27

Open the chart page →

2,896
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
python-multipart@0.0.5
0.0.27

Open the chart page →

4,085
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
python-multipart@0.0.20
0.0.27

Open the chart page →

8,923
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
python-multipart@0.0.9
0.0.27
clsen2024/gwangju_2-3:service-a-151b1d45961cd
python-multipart@0.0.9
0.0.27
clsen2024/gwangju_2-3:service-c-1efb1586c8299
python-multipart@0.0.9
0.0.27

Open the chart page →

6,491
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
python-multipart@0.0.26
0.0.27

Open the chart page →

3,281
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
python-multipart@0.0.22
0.0.27

Open the chart page →

3,430
notediscoveryhelmforgeVerified publisher2.0.11 of 1See more

notediscovery helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
python-multipart@0.0.6
0.0.27

Open the chart page →

1,241
graphiti-mcpkiberonlabs0.1.21 of 1See more

graphiti-mcp kiberonlabs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
python-multipart@0.0.20
0.0.27

Open the chart page →

3,393
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
python-multipart@0.0.26
0.0.27

Open the chart page →

9,620
pavkrzwiatrzyk0.0.31 of 1See more

pav krzwiatrzyk 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
witcherek7/pav:0.0.342a744f29ac0
python-multipart@0.0.5
0.0.27

Open the chart page →

1,132
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
python-multipart@0.0.20
0.0.27

Open the chart page →

8,405
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
python-multipart@0.0.5
0.0.27

Open the chart page →

7,315
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
python-multipart@0.0.20
0.0.27

Open the chart page →

5,823
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
python-multipart@0.0.5
0.0.27

Open the chart page →

43,341
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
moreillon/face-recognition-fastapi:x86bacb2ddd8394
python-multipart@0.0.5
0.0.27

Open the chart page →

8,556
my-fastapi-chartmy-fastapi-template0.1.01 of 1See more

my-fastapi-chart my-fastapi-template 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
john19968010/fastapi-template:latest31a90f6bd69c
python-multipart@0.0.5
0.0.27

Open the chart page →

967
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
python-multipart@0.0.20
0.0.27

Open the chart page →

7,310
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
python-multipart@0.0.24
0.0.27

Open the chart page →

2,555
mockoidcoidcmockVerified publisher0.0.11 of 1See more

mockoidc oidcmock 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
marcoimme/oidcmock:latestb6035c0721a8
python-multipart@0.0.6
0.0.27

Open the chart page →

2,298
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.02 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

2 of the 40 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
python-multipart@0.0.18
0.0.27
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
python-multipart@0.0.22
0.0.27

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
python-multipart@0.0.18
0.0.27

Open the chart page →

6,583
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42561.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
python-multipart@0.0.21
0.0.27

Open the chart page →

4,749

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
python-multipart@0.0.22
0.0.27
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
python-multipart@0.0.22
0.0.27
1
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
python-multipart@0.0.20
0.0.27
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
python-multipart@0.0.20
0.0.27
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
python-multipart@0.0.9
0.0.27
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
python-multipart@0.0.20
0.0.27
1
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
python-multipart@0.0.22
0.0.27
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
python-multipart@0.0.22
0.0.27
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
python-multipart@0.0.5
0.0.27
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
python-multipart@0.0.22
0.0.27
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
python-multipart@0.0.24
0.0.27
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
python-multipart@0.0.20
0.0.27
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
python-multipart@0.0.20
0.0.27
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
python-multipart@0.0.20
0.0.27
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.