Quick answers
- Is CVE-2026-53540 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-53540 being exploited in the wild.
- How severe is CVE-2026-53540?
- Low severity, with a CVSS score of 3.7, published 22 June 2026.
- Which products and versions are affected?
- python-multipart (PyPI) < 0.0.31, ECOSYSTEM:introduced=0,fixed=0.0.31.
- Is there a fix for CVE-2026-53540?
- Yes. python-multipart (PyPI): upgrade to 0.0.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-53540 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-53540?
- Check whether you run python-multipart (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- python-multipart (PyPI): upgrade to 0.0.31 or later
pip install "python-multipart>=0.0.31"
Technical details
A vulnerability exists in the parse_form() function of python-multipart where the Content-Length header is not validated for negative values. When a negative value is provided, the internal logic min(content_length - bytes_read, chunk_size) results in a negative value being passed to the stream's read() method, which triggers a read-until-EOF behavior. This causes the entire request body to be buffered into memory in a single operation rather than being processed in fixed-size chunks. Exploitation requires the application to call parse_form() directly using raw, un-normalized attacker-controlled headers. The issue is resolved in version 0.0.31.
Affected products
- Kludex python-multipart < 0.0.31
Identifiers
- CVE-2026-53540
- GHSA-v9pg-7xvm-68hf
- PYSEC-2026-3040
Timeline
- 2026-06-04: advisory: GitHub advisory published by maintainer
- 2026-06-22: disclosed: CVE published to NVD
- 2026-06-22: patched: Fix released in version 0.0.31