Interpretation Conflict in python-multipart - CVE-2026-53537
Published: November 9, 2026
Vulnerability identifier: #VU162677
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53537
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass upstream field name or filename controls when an inspecting component interprets multipart headers differently.
The vulnerability exists due to python-multipart decoding RFC 2231/5987 extended Content-Disposition parameters and allowing them to override plain parameters in multipart/form-data submissions. An unauthenticated remote attacker can submit conflicting plain and extended parameters so an upstream inspector validates one field name or filename while the application receives another.
Affected software
python-multipart
How to mitigate CVE-2026-53537
Install security update from vendor's website.
python-multipart - update to 0.0.30