CVE-2026-53539 Details
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.
A denial-of-service vulnerability has been identified in Python-Multipart versions prior to 0.0.30. The issue arises in the QuerystringParser when handling application/x-www-form-urlencoded bodies. The parser uses a two-step method to find field separators, first searching for '&' and then, if none is found, looking for ';'. This approach can lead to inefficient parsing, especially with bodies that use ';' as the separator and contain no '&'. An attacker can exploit this by sending a crafted body that causes the parser to perform excessive byte comparisons, leading to significant CPU consumption. This issue can block worker processes and degrade service.
Users are advised to upgrade to Python-Multipart version 0.0.30 or later, which improves the parsing method to treat only '&' as a separator, in accordance with the WHATWG URL standard, and reduces the parsing time to linear relative to the body length.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kludex/python-multipart/security/advisories/GHSA-5rvq-cxj2-64vf | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastapiexpert python-multipart | < 0.0.30 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |