CVE-2026-53540
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
Jun 22, 2026
CISA due date
—
The record
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-python-multipart | 0 | 0.0.20-160000.5.1 |
| openSUSE:Tumbleweed | python-python-multipart | 0 | 0.0.32-1.1 |
Related vulnerabilities
- CVE-2026-53537 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-53539 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-53538 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-24486 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-42561 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-40347 Python-Multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2024-53981 python-multipart is a streaming multipart parser for Python. Also affects python-python-multipart
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-1284