Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53539— Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

Quick assessment

Affected
Kludex python-multipart
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kludex python-multipart是Kludex的开源Web中间件流式解析库。 python-multipart 0.0.30之前版本存在资源管理错误漏洞，该漏洞源于解析application/x-www-form-urlencoded主体时，QuerystringParser定位字段分隔符的扫描方式不当，可能导致CPU消耗过高，攻击者可通过特制请求造成拒绝服务。以下版本受到影响：0.0.30之前版本。

CVSS 7.5 · High EPSS 0.46% · P38

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
Kludex python-multipart < 0.0.30 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53539

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Kludex python-multipart 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kludex python-multipart是Kludex的开源Web中间件流式解析库。 python-multipart 0.0.30之前版本存在资源管理错误漏洞，该漏洞源于解析application/x-www-form-urlencoded主体时，QuerystringParser定位字段分隔符的扫描方式不当，可能导致CPU消耗过高，攻击者可通过特制请求造成拒绝服务。以下版本受到影响：0.0.30之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Kludex python-multipart < 0.0.30 -

II. Public POCs for CVE-2026-53539

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Qwen3.6-35B-A3B · 6249 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-53539

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53539 (1)

Same Patch Batch · Kludex · 2026-06-22 · 6 CVEs total

CVE-2026-54283 7.5 HIGH Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded en
CVE-2026-53537 3.7 LOW Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended param
CVE-2026-53540 3.7 LOW Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
CVE-2026-53538 3.7 LOW Python-Multipart: Semicolon treated as querystring field separator enables parameter smugg
CVE-2026-54282 3.7 LOW Starlette: Unvalidated request path concatenated into authority poisons request.url.hostna

IV. Related Vulnerabilities

Same product: python-multipart
Same vendor: Kludex
Same weakness: CWE-400

V. Comments for CVE-2026-53539

No comments yet

Leave a comment