CVE-2026-53540
published 2026-06-22CVE-2026-53540: Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.34%
27.0th percentile
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
Affected
53 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | mcp-tools-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | mcp-tools-rhel9 | — | — |
| container-native-virtualization | ocp-virt-validation-checkup-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| fastapiexpert | python-multipart | < 0.0.31 | 0.0.31 |
| kludex | python-multipart | < 0.0.31 | 0.0.31 |
| kludex | python-multipart | >= 0 < 0.0.31 | 0.0.31 |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-cuda-rhel9 | — | — |
| rhaiis | vllm-neuron-rhel9 | — | — |
| rhaiis | vllm-rocm-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Kludex python-multipart up to 0.0.30 on Python parse_form improper validation of specified quantity in input (GHSA-v9pg-7xvm-68hf)
vuldb·2026-06-22·CVSS 3.7
CVE-2026-53540 [LOW] Kludex python-multipart up to 0.0.30 on Python parse_form improper validation of specified quantity in input (GHSA-v9pg-7xvm-68hf)
A vulnerability identified as problematic has been detected in Kludex python-multipart up to 0.0.30 on Python. Affected is the function parse_form. This manipulation causes improper validation of specified quantity in input.
This vulnerability is registered as CVE-2026-53540. Remote exploitation of the attack is possible. No exploit is available.
You should upgrade the affected component.
GHSA
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
ghsa·2026-06-15
CVE-2026-53540 [LOW] CWE-1284 python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
### Summary
`parse_form()` did not validate the `Content-Length` header before using it to bound its chunked read of the request body. A negative `Content-Length` turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks.
### Details
`parse_form()` reads the input stream in chunks, never reading more than the remaining `Content-Length` at a time. The per-chunk size is computed as `min(content_length - bytes_read, chunk_size)`. The header value was parsed to an integer without checking its sign, so a `Content-Length` of `-1` made this expression negative, and `input_stream.read(-1)` reads until end of stream. The intend
Red Hat
python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
vendor_redhat·2026-06-22·CVSS 3.7
CVE-2026-53540 [LOW] CWE-400 python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
Statement: A flaw was found in python-multipart where parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turns the bounded read into a read-until-EOF, loading the entire body into memory in a sin
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-53540 python-python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory [epel-all]
bugzilla·2026-07-01·CVSS 3.7
CVE-2026-53540 [LOW] CVE-2026-53540 python-python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory [epel-all]
CVE-2026-53540 python-python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
Discussion:
https://www.cve.or
Bugzilla
CVE-2026-53540 python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
bugzilla·2026-06-22·CVSS 3.7
CVE-2026-53540 [LOW] CVE-2026-53540 python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
CVE-2026-53540 python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
2026-06-22
Published