Input validation error in python-multipart - CVE-2026-53540
Published: November 9, 2026
Vulnerability identifier: #VU162680
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53540
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade application availability through excessive request body buffering in memory.
The vulnerability exists due to missing validation of negative Content-Length values in python-multipart's parse_form() when applications call it directly with raw client headers without normalizing those values. An unauthenticated remote attacker can submit concurrent requests with negative Content-Length headers to make each request body load into memory in a single read.
Affected software
python-multipart
How to mitigate CVE-2026-53540
Install security update from vendor's website.
python-multipart - update to 0.0.31