Back to overview

CVE-2026-53538

LOW
3.7
CVSS 3.1
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.

Metadata

CVE ID
CVE-2026-53538
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-09 18:13 UTC
Published
2026-06-22 16:56 UTC
Last updated
2026-06-22 16:56 UTC
Primary CWE
CWE-436
CWE-436: Interpretation Conflict
Vendor / Product
Kludex / python-multipart
Sources
cve.org  ·  NVD

Severity & Metrics

3.7 LOW CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products (1)
VendorProductPlatformVersions
Kludex python-multipart < 0.0.30
Weakness (CWE)
CWESourceDescription
CWE-436 cna CWE-436: Interpretation Conflict
CWE-444 cna CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVSS scores (1)
ScoreSeverityVersionSourceVector
3.7 LOW 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References (1)
Back to overview