Registry / web-framework / multipart

multipart

JSON →
library2.0.0pypypi✓ verified 24d ago

The `multipart` library (v1.3.1) provides a robust parser for `multipart/form-data` requests, commonly used in web applications for handling file uploads and complex form submissions. It supports both synchronous and asynchronous parsing, making it suitable for various web frameworks. The project is actively maintained with periodic security updates.

pip install multipart
INSTALL
IMPORT
SIG · MULTIPART
M
multipart
web-frameworkpythonv2.0.0
Install
1.6s avg
Import
41ms
Disk
16MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v2.0.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.95 runs
installs and imports cleanly · install 0.0s · import 0.044s · 17.9MB
glibc
py 3.103.95 runs
installs and imports cleanly · install 1.6s · import 0.038s · 18MB
16MB installed
● package 16MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

MultipartParser
from multipart import MultipartParser
from multipart import parse_form
MultipartPart
from multipart import MultipartPart
MultiDict
from multipart import MultiDict

This example demonstrates how to parse a `multipart/form-data` request body using `multipart.parse_form`. It simulates an HTTP request by creating an `io.BytesIO` object for the body and specifying `Content-Type` and `Content-Length` headers. The parsed data is returned as `form` (text fields) and `files` (file fields), which are then iterated over.

import io from multipart import parse_form # Simulate a multipart/form-data request body boundary = "----WebKitFormBoundaryXYZ" body_data = f"""--{boundary} Content-Disposition: form-data; name="username" testuser --{boundary} Content-Disposition: form-data; name="filefield"; filename="example.txt" Content-Type: text/plain This is a test file content. --{boundary}-- """ # Prepare the input for parse_form body_bytes = body_data.encode('utf-8') content_type = f"multipart/form-data; boundary={boundary}" content_length = len(body_bytes) # Create a file-like object (BytesIO for in-memory bytes) body_stream = io.BytesIO(body_bytes) # Parse the form form, files = parse_form(body_stream, content_type, content_length) # Access parsed data print("Form fields:") for name, value_list in form.items(): # Form fields can have multiple values, parse_form returns a list for each. print(f" {name}: {', '.join(value.decode('utf-8') for value in value_list)}") print("\nFiles:") for name, file_list in files.items(): for file_item in file_list: print(f" Field Name: {file_item.field_name}") print(f" Filename: {file_item.filename}") print(f" Content Type: {file_item.content_type}") print(f" Content (first 50 chars): {file_item.file.read()[:50].decode('utf-8')}") file_item.file.close() # Crucial to close the file-like object
Debug
Known issues
breakingIn versions of `multipart` prior to 1.0.0, the `parse_form` function was not directly exposed from the top-level `multipart` package, or its name/location was different, often resulting in an `ImportError`. When it was available (e.g., via a specific submodule), its signature also differed significantly, typically expecting a WSGI `environ` dictionary, unlike the 1.0.0+ versions which require an input stream, content type, and content length.
fix
To resolve an `ImportError`, ensure you are importing `parse_form` from the correct location for your specific `multipart` version (e.g., `from multipart.foo import parse_form_old_name`), or consider upgrading to `multipart` version 1.0.0 or higher. If upgrading, update your call to `parse_form` to explicitly pass the input stream, content type, and content length: `form, files = parse_form(input_stream, content_type_header, content_length_header)`.
affects: <1.0.0
breakingVersions prior to 1.2.2 and 1.3.1 are vulnerable to a Denial of Service (DoS) attack via CPU exhaustion and excessive memory consumption when processing specially crafted multipart requests. This is tracked as `GHSA-p2m9-wcp5-6qw3`.
fix
Upgrade to `multipart` version 1.3.1 or higher immediately to patch this critical security vulnerability. If you are on an older 1.x release, upgrade to the latest patch version available.
affects: <1.2.2, <1.3.1 (for 1.3.x branch)
gotchaFile-like objects returned for file fields in the `files` dictionary (e.g., `file_item.file`) are open streams. It is crucial to explicitly close these streams after processing their content to release system resources and avoid potential resource leaks, especially in high-traffic applications.
fix
Always call `file_item.file.close()` after you are done reading from or processing the file content for each `file_item`.
affects: All versions
Upgrade
Version history
2.0.0latest on PyPI · released Jul 18, 2026
Audit
Dependencies

No dependency data recorded yet.

Agent activity
5 hits · last 30 days
node
4
Resources
multipart — pip install multipart · libregistry