CVE-2026-53538
LOW
INFO
Priority: 0.01
BB Relevance:
57/100
Published: 2026-06-22
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
Low
A:
None
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| fastapiexpert | python-multipart | < 0.0.30 |
References & Advisories (1)
Vendor Advisory