Low severity3.7GHSA Advisory· Published Jun 22, 2026· Updated Jun 26, 2026
CVE-2026-53540
CVE-2026-53540
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
python-multipartPyPI | < 0.0.31 | 0.0.31 |
Affected products
12- Range: < 0.0.31
- cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:*Range: <0.0.31
- osv-coords10 versionspkg:apk/chainguard/airflow-3pkg:apk/chainguard/airflow-core-3pkg:apk/chainguard/litellmpkg:apk/chainguard/tritonserver-backend-vllm-cuda-12.9pkg:apk/chainguard/wazuh-manager-frameworkpkg:apk/chainguard/wazuh-manager-framework-fipspkg:apk/wolfi/airflow-3pkg:pypi/python-multipartpkg:rpm/opensuse/python-python-multipart&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-python-multipart&distro=openSUSE%20Tumbleweed
< 3.2.2-r7+ 9 more
- (no CPE)range: < 3.2.2-r7
- (no CPE)range: < 3.2.2-r7
- (no CPE)range: < 1.89.0-r2
- (no CPE)range: < 25.9.0_git20260617-r0
- (no CPE)range: < 4.14.5-r4
- (no CPE)range: < 4.14.5-r6
- (no CPE)range: < 3.2.2-r7
- (no CPE)range: < 0.0.31
- (no CPE)range: < 0.0.20-160000.5.1
- (no CPE)range: < 0.0.32-1.1
Patches
Vulnerability mechanics
References
2- github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hfnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-v9pg-7xvm-68hfghsaADVISORY
News mentions
0No linked articles in our index yet.