CVE-2026-53538
published 2026-06-22CVE-2026-53538: Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in…
PriorityP415low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.26%
17.0th percentile
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | mcp-tools-rhel9 | — | — |
| container-native-virtualization | ocp-virt-validation-checkup-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| fastapiexpert | python-multipart | < 0.0.30 | 0.0.30 |
| kludex | python-multipart | — | — |
| kludex | python-multipart | >= 0 < 0.0.30 | 0.0.30 |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-neuron-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-automl-rhel9 | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
ghsa5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
vendor_redhat·2026-06-22·CVSS 5.9
CVE-2026-53538 [MEDIUM] CWE-1288 python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
A flaw was found in Python-Multipart, a tool used for processing web form data. A remote attacker co
Red Hat
python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies
vendor_redhat·2026-06-22·CVSS 3.7
CVE-2026-53539 [LOW] CWE-1333 python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies
python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend sec
VulDB
Kludex python-multipart up to 0.0.29 on Python interpretation conflict (GHSA-6jv3-5f52-599m)
vuldb·2026-06-22·CVSS 3.7
CVE-2026-53538 [LOW] Kludex python-multipart up to 0.0.29 on Python interpretation conflict (GHSA-6jv3-5f52-599m)
A vulnerability categorized as problematic has been discovered in Kludex python-multipart up to 0.0.29 on Python. This impacts an unknown function. The manipulation results in interpretation conflict.
This vulnerability is cataloged as CVE-2026-53538. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
ghsa·2026-06-15·CVSS 5.9
CVE-2026-53538 [MEDIUM] CWE-436 python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
### Summary
`QuerystringParser` treated `;` as a field separator in `application/x-www-form-urlencoded` bodies, in addition to `&`. The [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing), modern browsers, and Python's `urllib.parse` (since the CVE-2021-23336 fix) treat only `&` as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component.
### Details
In `python_multipart/multipart.py`, the `FIELD_NAME` and `FIELD_DATA` states located the next separator by scanning for `&` and, failing that
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-53538 python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
bugzilla·2026-06-22·CVSS 5.9
CVE-2026-53538 [MEDIUM] CVE-2026-53538 python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
CVE-2026-53538 python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
Bugzilla
CVE-2025-53538 suricata: Suricata resource starvation [fedora-42]
bugzilla·2025-07-22·CVSS 7.5
CVE-2025-53538 [HIGH] CVE-2025-53538 suricata: Suricata resource starvation [fedora-42]
CVE-2025-53538 suricata: Suricata resource starvation [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases
2026-06-22
Published