CVE-2026-53540

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Python-Multipart es un analizador multipart de transmisión para Python. Antes de 0.0.31, parse_form() no validaba el encabezado Content-Length antes de usarlo para limitar su lectura en fragmentos del cuerpo de la solicitud. Un Content-Length negativo convertía la lectura limitada en una lectura hasta EOF, por lo que el cuerpo completo se cargaba en memoria en una sola lectura en lugar de en fragmentos de tamaño fijo. Esta vulnerabilidad está corregida en 0.0.31.

Information

Published : 2026-06-22 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-53540

Mitre link : CVE-2026-53540

CVE.ORG link : CVE-2026-53540

JSON object : View

Products Affected

fastapiexpert

python-multipart

CWE

CWE-1284

Improper Validation of Specified Quantity in Input

{"id": "CVE-2026-53540", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53540", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T17:21:49.069742Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Kludex", "product": "python-multipart", "versions": [{"status": "affected", "version": "< 0.0.31"}]}]}], "published": "2026-06-22T18:16:44.497", "references": [{"url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31."}, {"lang": "es", "value": "Python-Multipart es un analizador multipart de transmisi\u00f3n para Python. Antes de 0.0.31, parse_form() no validaba el encabezado Content-Length antes de usarlo para limitar su lectura en fragmentos del cuerpo de la solicitud. Un Content-Length negativo convert\u00eda la lectura limitada en una lectura hasta EOF, por lo que el cuerpo completo se cargaba en memoria en una sola lectura en lugar de en fragmentos de tama\u00f1o fijo. Esta vulnerabilidad est\u00e1 corregida en 0.0.31."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastapiexpert:python-multipart:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "B35A0C05-3D3C-4063-8A25-62EEE68E480B", "versionEndExcluding": "0.0.31"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}