CVE-2026-53540 | Python-Multipart is a streaming multipart parser for Python.… | CVSS 3.7 LOW

Description

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.

Metadata

CVE ID: CVE-2026-53540
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-09 18:13 UTC
Published: 2026-06-22 16:58 UTC
Last updated: 2026-06-22 17:21 UTC
Primary CWE: CWE-1284
CWE-1284: Improper Validation of Specified Quantity in Input
Vendor / Product: Kludex / python-multipart
Sources: cve.org · NVD

Severity & Metrics

3.7 LOW CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Kludex	python-multipart	—	< 0.0.31

Weakness (CWE)

CWE	Source	Description
CWE-1284	cna	CWE-1284: Improper Validation of Specified Quantity in Input

CVSS scores (1)

Score	Severity	Version	Source	Vector
3.7	LOW	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References (1)

https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf