CVE-2026-53538 Details
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
A vulnerability in Python-Multipart versions prior to 0.0.30 allows for parameter smuggling by misinterpreting semicolons as field separators in application/x-www-form-urlencoded data. This behavior contrasts with the WHATWG URL standard, modern browsers, and Python's urllib.parse, all of which recognize only ampersands as separators. The flaw enables an attacker to bypass upstream components that inspect request bodies, potentially leading to the injection of unauthorized form fields into the backend processing.
Users are advised to upgrade to Python-Multipart version 0.0.30 or later, which aligns with the WHATWG URL standard by treating only ampersands as field separators. Version 0.0.30 is available on the Python Package Index (PyPI).
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kludex/python-multipart/security/advisories/GHSA-6jv3-5f52-599m | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastapiexpert python-multipart | < 0.0.30 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |