CVE-2026-53538
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
Jun 22, 2026
CISA due date
—
The record
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-python-multipart | 0 | 0.0.20-160000.5.1 |
| openSUSE:Tumbleweed | python-python-multipart | 0 | 0.0.32-1.1 |
Related vulnerabilities
- CVE-2026-53537 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-53539 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-53540 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-24486 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-42561 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-40347 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2024-53981 python-multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that… CWE-436