CVE-2026-53539: Kludex Python-Multipart denial of service in QuerystringParser

CVE-2026-53539 · Severity: high · CVSS 7.5 · Published 2026-06-22

A vulnerability in the python-multipart library, commonly used by web frameworks like FastAPI and Starlette, allows attackers to crash or slow down web services. By sending a specially crafted web form, an attacker can force the server to spend excessive amounts of processing power on a single request. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive to legitimate users.

Technologies: python-multipart (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-53539 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53539 being exploited in the wild.
How severe is CVE-2026-53539?
High severity, with a CVSS score of 7.5, published 22 June 2026.
Which products and versions are affected?
python-multipart (PyPI) < 0.0.30, ECOSYSTEM:introduced=0,fixed=0.0.30.
Is there a fix for CVE-2026-53539?
Yes. python-multipart (PyPI): upgrade to 0.0.30 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53539 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53539?
Check whether you run python-multipart (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • python-multipart (PyPI): upgrade to 0.0.30 or later
    pip install "python-multipart>=0.0.30"

Technical details

The QuerystringParser in python-multipart (prior to version 0.0.30) implements an inefficient two-step lookup for field separators when parsing 'application/x-www-form-urlencoded' bodies. It first scans the entire remaining buffer for '&' before falling back to ';'. If a body uses ';' as a separator and contains no '&', the parser performs a full failed scan of the remaining buffer for every field iteration, resulting in O(B^2) complexity. A remote, unauthenticated attacker can send a small body (e.g., "a;a;a;...") to trigger high CPU consumption, potentially exhausting worker processes in synchronous environments like FastAPI or Starlette. The issue is resolved in version 0.0.30 by adopting a single bounded scan that only recognizes '&' as a separator.

Affected products

  • Kludex python-multipart < 0.0.30

Identifiers

  • CVE-2026-53539
  • GHSA-5rvq-cxj2-64vf
  • PYSEC-2026-3036

Timeline

  • 2026-06-04: advisory: GitHub advisory published by maintainer
  • 2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.