SB2026110958 - Multiple vulnerabilities in python-multipart

Description

This security bulletin contains information about 3 vulnerabilities.

1) Interpretation Conflict (CVE-ID: CVE-2026-53537)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to bypass upstream field name or filename controls when an inspecting component interprets multipart headers differently.

The vulnerability exists due to python-multipart decoding RFC 2231/5987 extended Content-Disposition parameters and allowing them to override plain parameters in multipart/form-data submissions. An unauthenticated remote attacker can submit conflicting plain and extended parameters so an upstream inspector validates one field name or filename while the application receives another.

2) Interpretation Conflict (CVE-ID: CVE-2026-53538)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to bypass upstream form validation by smuggling extra or overriding fields to a backend application.

The vulnerability exists due to python-multipart's QuerystringParser treating semicolons as separators in URL-encoded request bodies when an upstream inspecting component recognizes only ampersands. An unauthenticated remote attacker can submit a semicolon-delimited duplicate field that the backend interprets as an overriding value unseen by the upstream validator.

3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-53539)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service to applications using python-multipart to parse form requests.

The vulnerability exists due to quadratic-time separator searches in QuerystringParser when processing URL-encoded form bodies containing semicolon-separated fields and no ampersands. An unauthenticated remote attacker can submit crafted form bodies that occupy workers for seconds per request and exhaust available workers through concurrent requests.

Remediation

Install update from vendor's website.

References

• https://github.com/Kludex/python-multipart/security/advisories/GHSA-vffw-93wf-4j4q
• https://github.com/Kludex/python-multipart/security/advisories/GHSA-6jv3-5f52-599m
• https://github.com/Kludex/python-multipart/security/advisories/GHSA-5rvq-cxj2-64vf