CVE-2026-53538
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
python-multipartPyPI | < 0.0.30 | 0.0.30 |
Affected products
13- Range: < 0.0.30
- cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:*Range: <0.0.30
- osv-coords11 versionspkg:apk/chainguard/airflow-3pkg:apk/chainguard/airflow-core-3pkg:apk/chainguard/airflow-postgres-fips-3pkg:apk/chainguard/litellmpkg:apk/chainguard/tritonserver-backend-vllm-cuda-12.9pkg:apk/chainguard/wazuh-manager-frameworkpkg:apk/chainguard/wazuh-manager-framework-fipspkg:apk/wolfi/airflow-3pkg:pypi/python-multipartpkg:rpm/opensuse/python-python-multipart&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-python-multipart&distro=openSUSE%20Tumbleweed
< 3.2.2-r7+ 10 more
- (no CPE)range: < 3.2.2-r7
- (no CPE)range: < 3.2.2-r3
- (no CPE)range: < 3.2.2-r1
- (no CPE)range: < 1.89.0-r2
- (no CPE)range: < 25.9.0_git20260617-r0
- (no CPE)range: < 4.14.5-r4
- (no CPE)range: < 4.14.5-r4
- (no CPE)range: < 3.2.2-r7
- (no CPE)range: < 0.0.30
- (no CPE)range: < 0.0.20-160000.5.1
- (no CPE)range: < 0.0.32-1.1
Patches
Vulnerability mechanics
References
2- github.com/Kludex/python-multipart/security/advisories/GHSA-6jv3-5f52-599mnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-6jv3-5f52-599mghsaADVISORY
News mentions
0No linked articles in our index yet.