Uploads with a very large number of multipart parts can exhaust CPU or disk. The fix introduced the max_multipart_body_parts INI setting.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.2 | < 8.2.3 | 8.2.3 |
| PHP 8.1 | < 8.1.16 | 8.1.16 |
| PHP 8.0 | < 8.0.28 | 8.0.28 |
Older branches: not assessed
Exploitation conditions
No special conditions are documented.
Remediation
Upgrade to 8.0.28, 8.1.16, 8.2.3 or later and review max_multipart_body_parts and max_file_uploads for your workload.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 7.5 v3.1 | NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source