{"id":"CVE-2026-53538","aliases":["CLSA-2026-1782954025","DEBIAN-CVE-2026-53538","EUVD-2026-38323","GHSA-6jv3-5f52-599m","PYSEC-2026-3037","ROOT-APP-PYPI-CVE-2026-53538","SUSE-SU-2026:22372-1","UBUNTU-CVE-2026-53538","openSUSE-SU-2026:11099-1","openSUSE-SU-2026:21066-1"],"status":"published","title":"Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00256,"percentile":0.17276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436","CWE-444"],"published":"2026-06-15T20:22:25Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"PyPI","package":"python-multipart","fixed_in":["0.0.30"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"python-multipart","fixed_in":["0.0.32-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"python-multipart","fixed_in":["0.0.27+aikido.3","0.0.26+aikido.5","0.0.29+aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.30"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.6"},{"fixed":"0.0.6.post5+tuxcare"}]}],"versions":["0.0.6","0.0.6.post1+tuxcare","0.0.6.post2+tuxcare","0.0.6.post3+tuxcare","0.0.6.post4+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.17-1","0.0.17-2","0.0.17-3","0.0.17-4","0.0.17-5","0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1","0.0.32-1","0.0.5-3","0.0.6-1","0.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1","0.0.32-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.32-1"}]}],"versions":["0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1"]},{"source":"osv","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.30"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.30"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"Root:PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.27+aikido.3"},{"fixed":"0.0.26+aikido.5"},{"fixed":"0.0.29+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.5-2","0.0.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.5-3","0.0.6-1","0.0.9-1","0.0.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1.1","0.0.26-1","0.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1","0.0.20-1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.32-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.5.1"}]}],"bundled":4}],"products":[{"vendor":"fastapiexpert","product":"python-multipart"},{"vendor":"kludex","product":"python-multipart"}],"references":[{"url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-6jv3-5f52-599m","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/advisories/GHSA-6jv3-5f52-599m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53538.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53538","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53538","tags":["advisory"]},{"url":"https://github.com/Kludex/python-multipart","tags":["package"]},{"url":"https://pypi.org/project/python-multipart","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622372-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268488","tags":["report"]},{"url":"https://bugzilla.suse.com/1268496","tags":["report"]},{"url":"https://bugzilla.suse.com/1268500","tags":["report"]},{"url":"https://bugzilla.suse.com/1268506","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53540","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-53538","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53538","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-53538","title":"Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T16:56:32.628Z","modified":"2026-06-23T16:08:22.05Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-436","CWE-444"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-38323","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T16:56:32Z","modified":"2026-06-23T16:08:22Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-6jv3-5f52-599m","title":"python-multipart: Semicolon treated as querystring field separator enables parameter smuggling","description":"### Summary\n\n`QuerystringParser` treated `;` as a field separator in `application/x-www-form-urlencoded` bodies, in addition to `\u0026`. The [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing), modern browsers, and Python's `urllib.parse` (since the CVE-2021-23336 fix) treat only `\u0026` as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component.\n\n### Details\n\nIn `python_multipart/multipart.py`, the `FIELD_NAME` and `FIELD_DATA` states located the next separator by scanning for `\u0026` and, failing that, for `;`:\n\n```python\nsep_pos = data.find(b\"\u0026\", i)\nif sep_pos == -1:\n    sep_pos = data.find(b\";\", i)\n```\n\nAs a result, `;` acted as a field boundary. Because the fallback only triggered when no `\u0026` remained in the current chunk, tokenization also depended on unrelated bytes later in the buffer and on how the body was split across `write()` calls. This is the same class of issue as CVE-2021-23336 in CPython's `urllib.parse`.\n\nFor example, a body inspecting WAF or gateway that follows the WHATWG rule (only `\u0026` separates fields) receives:\n\n```\nrole=user\u0026x=;role=admin\n```\n\nThe upstream parses two fields, `role=user` and `x=\";role=admin\"`, sees a benign `role=user`, and forwards the request. `QuerystringParser` parsed the same bytes as three fields: `role=\"user\"`, `x=\"\"`, and `role=\"admin\"`. The application (for example via Starlette/FastAPI `request.form()`, where the last value wins) then received `role=admin`, a value the upstream validator never saw.\n\nThe parser is reachable through the public `QuerystringParser` class, the high level `FormParser`, `create_form_parser`, and `parse_form` APIs, and Starlette/FastAPI `request.form()` for url encoded bodies.\n\n### Impact\n\nInterpretation conflict / HTTP parameter pollution. An attacker can smuggle extra or overriding form fields past an upstream component that applies the WHATWG separator rule, reaching the backend with parameters the intermediary did not observe.\n\n### Mitigation\n\nUpgrade to `python-multipart` `0.0.30` or later, which treats only `\u0026` as a field separator per the [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing). `;` is parsed as ordinary field data, matching `urllib.parse`, browsers, and other compliant parsers.","status":"published","published":"2026-06-15T20:22:25Z","modified":"2026-06-15T20:22:27Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-436","CWE-444"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-53538","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T18:16:44.223Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-436","CWE-444"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-53538","title":"Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T16:56:32.628Z","modified":"2026-10-28T02:31:07.101262818Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-436","CWE-444"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-53538","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T18:16:44.223Z","modified":"2026-10-26T11:47:36.013508701Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-6jv3-5f52-599m","title":"python-multipart: Semicolon treated as querystring field separator enables parameter smuggling","description":"### Summary\n\n`QuerystringParser` treated `;` as a field separator in `application/x-www-form-urlencoded` bodies, in addition to `\u0026`. The [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing), modern browsers, and Python's `urllib.parse` (since the CVE-2021-23336 fix) treat only `\u0026` as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component.\n\n### Details\n\nIn `python_multipart/multipart.py`, the `FIELD_NAME` and `FIELD_DATA` states located the next separator by scanning for `\u0026` and, failing that, for `;`:\n\n```python\nsep_pos = data.find(b\"\u0026\", i)\nif sep_pos == -1:\n    sep_pos = data.find(b\";\", i)\n```\n\nAs a result, `;` acted as a field boundary. Because the fallback only triggered when no `\u0026` remained in the current chunk, tokenization also depended on unrelated bytes later in the buffer and on how the body was split across `write()` calls. This is the same class of issue as CVE-2021-23336 in CPython's `urllib.parse`.\n\nFor example, a body inspecting WAF or gateway that follows the WHATWG rule (only `\u0026` separates fields) receives:\n\n```\nrole=user\u0026x=;role=admin\n```\n\nThe upstream parses two fields, `role=user` and `x=\";role=admin\"`, sees a benign `role=user`, and forwards the request. `QuerystringParser` parsed the same bytes as three fields: `role=\"user\"`, `x=\"\"`, and `role=\"admin\"`. The application (for example via Starlette/FastAPI `request.form()`, where the last value wins) then received `role=admin`, a value the upstream validator never saw.\n\nThe parser is reachable through the public `QuerystringParser` class, the high level `FormParser`, `create_form_parser`, and `parse_form` APIs, and Starlette/FastAPI `request.form()` for url encoded bodies.\n\n### Impact\n\nInterpretation conflict / HTTP parameter pollution. An attacker can smuggle extra or overriding form fields past an upstream component that applies the WHATWG separator rule, reaching the backend with parameters the intermediary did not observe.\n\n### Mitigation\n\nUpgrade to `python-multipart` `0.0.30` or later, which treats only `\u0026` as a field separator per the [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing). `;` is parsed as ordinary field data, matching `urllib.parse`, browsers, and other compliant parsers.","status":"published","published":"2026-06-15T20:22:25Z","modified":"2026-09-10T03:51:07.925895532Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-436","CWE-444"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"PYSEC-2026-3037","title":"python-multipart: Semicolon treated as querystring field separator enables parameter smuggling","description":"### Summary\n\n`QuerystringParser` treated `;` as a field separator in `application/x-www-form-urlencoded` bodies, in addition to `\u0026`. The [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing), modern browsers, and Python's `urllib.parse` (since the CVE-2021-23336 fix) treat only `\u0026` as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component.\n\n### Details\n\nIn `python_multipart/multipart.py`, the `FIELD_NAME` and `FIELD_DATA` states located the next separator by scanning for `\u0026` and, failing that, for `;`:\n\n```python\nsep_pos = data.find(b\"\u0026\", i)\nif sep_pos == -1:\n    sep_pos = data.find(b\";\", i)\n```\n\nAs a result, `;` acted as a field boundary. Because the fallback only triggered when no `\u0026` remained in the current chunk, tokenization also depended on unrelated bytes later in the buffer and on how the body was split across `write()` calls. This is the same class of issue as CVE-2021-23336 in CPython's `urllib.parse`.\n\nFor example, a body inspecting WAF or gateway that follows the WHATWG rule (only `\u0026` separates fields) receives:\n\n```\nrole=user\u0026x=;role=admin\n```\n\nThe upstream parses two fields, `role=user` and `x=\";role=admin\"`, sees a benign `role=user`, and forwards the request. `QuerystringParser` parsed the same bytes as three fields: `role=\"user\"`, `x=\"\"`, and `role=\"admin\"`. The application (for example via Starlette/FastAPI `request.form()`, where the last value wins) then received `role=admin`, a value the upstream validator never saw.\n\nThe parser is reachable through the public `QuerystringParser` class, the high level `FormParser`, `create_form_parser`, and `parse_form` APIs, and Starlette/FastAPI `request.form()` for url encoded bodies.\n\n### Impact\n\nInterpretation conflict / HTTP parameter pollution. An attacker can smuggle extra or overriding form fields past an upstream component that applies the WHATWG separator rule, reaching the backend with parameters the intermediary did not observe.\n\n### Mitigation\n\nUpgrade to `python-multipart` `0.0.30` or later, which treats only `\u0026` as a field separator per the [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing). `;` is parsed as ordinary field data, matching `urllib.parse`, browsers, and other compliant parsers.","status":"published","published":"2026-07-13T15:46:17.263527Z","modified":"2026-07-13T16:33:29.021693741Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"UBUNTU-CVE-2026-53538","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T18:16:00Z","modified":"2026-10-17T13:00:25.220707117Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1782954025","title":"TuxCare security update for python-multipart (2 CVEs)","description":"TuxCare rebuilt python-multipart to address 2 CVEs. Fixed in 0.0.6.post5+tuxcare.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T09:48:05.283777685Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"openSUSE-SU-2026:11099-1","title":"python311-python-multipart-0.0.32-1.1 on GA media","description":"These are all security issues fixed in the python311-python-multipart-0.0.32-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:22.394275076Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21066-1","title":"Security update for python-python-multipart","description":"This update for python-python-multipart fixes the following issues\n\n- CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling (bsc#1268506).\n- CVE-2026-53538: urlencoded requests containing semicolons can lead to form field smuggling (bsc#1268496).\n- CVE-2026-53539: small crafted body can cause a denial of service (bsc#1268500).\n- CVE-2026-53540: crafted request buffers can lead to degrading availability (bsc#1268488).\n","status":"published","published":"2026-06-26T07:58:44Z","modified":"2026-06-30T18:24:38.453792818Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-PYPI-CVE-2026-53538","title":"CVE-2026-53538 in python-multipart - Patched by Root","description":"Root has patched CVE-2026-53538 in the python-multipart package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-08-17T09:57:27Z","modified":"2026-08-17T11:00:07.953300261Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2026:22372-1","title":"Security update for python-python-multipart","description":"This update for python-python-multipart fixes the following issues\n\n- CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling (bsc#1268506).\n- CVE-2026-53538: urlencoded requests containing semicolons can lead to form field smuggling (bsc#1268496).\n- CVE-2026-53539: small crafted body can cause a denial of service (bsc#1268500).\n- CVE-2026-53540: crafted request buffers can lead to degrading availability (bsc#1268488).\n","status":"published","published":"2026-06-26T07:58:40Z","modified":"2026-07-02T18:24:14.95877653Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}