Inefficient Algorithmic Complexity in python-multipart - CVE-2026-53539
Published: November 9, 2026
Vulnerability identifier: #VU162679
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53539
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service to applications using python-multipart to parse form requests.
The vulnerability exists due to quadratic-time separator searches in QuerystringParser when processing URL-encoded form bodies containing semicolon-separated fields and no ampersands. An unauthenticated remote attacker can submit crafted form bodies that occupy workers for seconds per request and exhaust available workers through concurrent requests.
Affected software
python-multipart
How to mitigate CVE-2026-53539
Install security update from vendor's website.
python-multipart - update to 0.0.30