CVE-2026-53539
published 2026-06-22CVE-2026-53539: Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.46%
38.3th percentile
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fastapiexpert | python-multipart | < 0.0.30 | 0.0.30 |
| kludex | python-multipart | < 0.0.30 | 0.0.30 |
| kludex | python-multipart | — | — |
| kludex | python-multipart | >= 0 < 0.0.30 | 0.0.30 |
| shell-quote_project | shell-quote | >= 0 < 1.9.0 | 1.9.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
ghsa·2026-07-20
CVE-2026-13311 [HIGH] CWE-407 shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
### Summary
`shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses
`Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing
array, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who
can submit a string to any code path that calls `parse()` on it can block the single-threaded
Node.js event loop for tens of seconds with a small input — a denial of service. The trigger
needs **no shell metacharacters** (plain space-separated words suffice), so input filters that
only screen for `;`, `|`, `$`, or backticks do not help.
### Root cause
`parse.js` (lines 200–203), in `parseInternal` — this path runs on **every** `parse()` cal
VulDB
Kludex python-multipart up to 0.0.29 on Python resource consumption (GHSA-5rvq-cxj2-64vf)
vuldb·2026-06-22·CVSS 7.5
CVE-2026-53539 [HIGH] Kludex python-multipart up to 0.0.29 on Python resource consumption (GHSA-5rvq-cxj2-64vf)
A vulnerability was found in Kludex python-multipart up to 0.0.29 on Python and classified as problematic. Impacted is an unknown function. Such manipulation leads to resource consumption.
This vulnerability is referenced as CVE-2026-53539. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
ghsa·2026-06-15
CVE-2026-53539 [HIGH] CWE-400 python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
### Summary
When parsing `application/x-www-form-urlencoded` bodies, `QuerystringParser` located the field separator with a two step lookup: it first scanned the entire remaining buffer for `&`, and only when no `&` existed anywhere ahead did it fall back to scanning for `;`. For a body that uses `;` as the separator and contains no `&`, every field iteration performed a full failed `&` scan over the entire remaining buffer before locating the nearby `;`. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk.
An attacker can submit a small crafted body of the form `a;a;a;...` and cause the parser to spend seconds of CPU per request.
Red Hat
python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies
vendor_redhat·2026-06-22·CVSS 3.7
CVE-2026-53539 [LOW] CWE-1333 python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies
python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend sec
No detection rules found.
No public exploits indexed.
2026-06-22
Published