Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M
CVE-2026-53539Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
High 7.5
In plain English
A high-severity uncontrolled resource consumption in python-multipart from Kludex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-multipart | no fix listed | DEBIAN-CVE-2026-53539 |
| Debian:13 | python-multipart | no fix listed | DEBIAN-CVE-2026-53539 |
| Debian:14 | python-multipart | 0.0.32-1 | DEBIAN-CVE-2026-53539 |
| PyPI | python-multipart | 0.0.30 | PYSEC-2026-3036 |
| PyPI | python-multipart | 0.0.30 | GHSA-5rvq-cxj2-64vf |
| Ubuntu:25.10 | python-multipart | no fix listed | UBUNTU-CVE-2026-53539 |
| Ubuntu:26.04:LTS | python-multipart | no fix listed | UBUNTU-CVE-2026-53539 |
| Ubuntu:26.10 | python-multipart | no fix listed | UBUNTU-CVE-2026-53539 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kludex | python-multipart | < 0.0.30 |
Weakness: CWE-400, CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H