CVE-2026-53540 Details
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
A vulnerability exists in Python-Multipart versions prior to 0.0.31, where the 'parse_form()' function failed to validate the 'Content-Length' header before using it to limit the chunked reading of the request body. This oversight allowed a negative 'Content-Length' to cause an unbounded read of the entire body into memory at once, rather than in fixed-size chunks. The issue is particularly relevant for custom WSGI or 'http.server' handlers that pass raw client headers to 'parse_form()'. In such cases, a crafted request could load the body into memory all at once, potentially degrading application performance under concurrent requests.
Users are advised to upgrade to Python-Multipart version 0.0.31 or later, which includes a fix that rejects negative 'Content-Length' values with a 'ValueError' before reading the request stream.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastapiexpert python-multipart | < 0.0.31 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |