HIGH7.5
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ALT-PU-2026-9338-1Package update python3-module-python-multipart in branch sisyphus_loongarch64
Severity:
Closed issues (4)
LOW3.7
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
CVSS 3.xLOW 3.7
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NLOW3.7
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
CVSS 3.xLOW 3.7
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LLOW3.7
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
CVSS 3.xLOW 3.7
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
- https://github.com/Kludex/python-multipart/security/advisories/GHSA-vffw-93wf-4j4q
- https://nvd.nist.gov/vuln/detail/CVE-2026-53537
- https://github.com/Kludex/python-multipart
- https://github.com/advisories/GHSA-vffw-93wf-4j4q
- https://github.com/pypa/advisory-database/blob/main/vulns/python-multipart/PYSEC-2026-3041.yaml
- https://pypi.org/project/python-multipart
- CVE-2026-53537