{"id":"CVE-2026-53539","aliases":["DEBIAN-CVE-2026-53539","EUVD-2026-38322","GHSA-5rvq-cxj2-64vf","PYSEC-2026-3036","RHLW-2026-49c9d6d5f43496cc","RHLW-2026-5412f98f0e0f6e5e","RHLW-2026-bb458408b595d6af","ROOT-APP-PYPI-CVE-2026-53539","SUSE-SU-2026:22372-1","UBUNTU-CVE-2026-53539","openSUSE-SU-2026:21066-1"],"status":"published","title":"Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0046,"percentile":0.40188,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2026-06-15T20:24:09Z","modified":"2026-11-10T08:30:02Z","fixes":[{"ecosystem":"PyPI","package":"python-multipart","fixed_in":["0.0.30"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"python-multipart","fixed_in":["0.0.32-1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:PyPI","package":"python-multipart","fixed_in":["0.0.27+rhlw.1","0.0.29+rhlw.1","0.0.28+rhlw.1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"python-multipart","fixed_in":["0.0.5+aikido.1","0.0.29+aikido.1","0.0.26+aikido.3","0.0.27+aikido.1","0.0.27+aikido.2","0.0.29+aikido.2","0.0.26+aikido.4","0.0.27+aikido.3","0.0.26+aikido.5","0.0.29+aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.30"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.17-1","0.0.17-2","0.0.17-3","0.0.17-4","0.0.17-5","0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1","0.0.32-1","0.0.5-3","0.0.6-1","0.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1","0.0.32-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.32-1"}]}],"versions":["0.0.20-1","0.0.20-1.1","0.0.20-1.1~deb13u1","0.0.22-1","0.0.26-1"]},{"source":"osv","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.30"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.30"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.27+rhlw.1"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.29+rhlw.1"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.28","0.0.29","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.28"},{"fixed":"0.0.28+rhlw.1"}]}],"versions":["0.0.28"]},{"source":"osv","ecosystem":"Root:PyPI","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.5+aikido.1"},{"fixed":"0.0.29+aikido.1"},{"fixed":"0.0.26+aikido.3"},{"fixed":"0.0.27+aikido.1"},{"fixed":"0.0.27+aikido.2"},{"fixed":"0.0.29+aikido.2"},{"fixed":"0.0.26+aikido.4"},{"fixed":"0.0.27+aikido.3"},{"fixed":"0.0.26+aikido.5"},{"fixed":"0.0.29+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.5-2","0.0.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.5-3","0.0.6-1","0.0.9-1","0.0.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1.1","0.0.26-1","0.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1","0.0.20-1.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-python-multipart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20-160000.5.1"}]}],"bundled":4}],"products":[{"vendor":"fastapiexpert","product":"python-multipart"},{"vendor":"kludex","product":"python-multipart"}],"references":[{"url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-5rvq-cxj2-64vf","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/advisories/GHSA-5rvq-cxj2-64vf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53539.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53539","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53539","tags":["advisory"]},{"url":"https://github.com/Kludex/python-multipart","tags":["package"]},{"url":"https://pypi.org/project/python-multipart","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622372-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268488","tags":["report"]},{"url":"https://bugzilla.suse.com/1268496","tags":["report"]},{"url":"https://bugzilla.suse.com/1268500","tags":["report"]},{"url":"https://bugzilla.suse.com/1268506","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53540","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-53539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53539","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-53539","title":"Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T16:55:42.787Z","modified":"2026-06-23T16:08:36.474Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-38322","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T16:55:42Z","modified":"2026-06-23T16:08:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-5rvq-cxj2-64vf","title":"python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","description":"### Summary\n\nWhen parsing `application/x-www-form-urlencoded` bodies, `QuerystringParser` located the field separator with a two step lookup: it first scanned the entire remaining buffer for `\u0026`, and only when no `\u0026` existed anywhere ahead did it fall back to scanning for `;`. For a body that uses `;` as the separator and contains no `\u0026`, every field iteration performed a full failed `\u0026` scan over the entire remaining buffer before locating the nearby `;`. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk.\n\nAn attacker can submit a small crafted body of the form `a;a;a;...` and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes.\n\n### Details\n\nIn `python_multipart/multipart.py`, both the `FIELD_NAME` and `FIELD_DATA` states located the next separator like this:\n\n```python\nsep_pos = data.find(b\"\u0026\", i)\nif sep_pos == -1:\n    sep_pos = data.find(b\";\", i)\n```\n\n`data.find(b\"\u0026\", i)` scans from `i` to the end of the buffer and returns `-1` only when there is no `\u0026` anywhere in the remainder. For a `;` separated body with no `\u0026`, this failed full buffer scan repeats once per field, making parsing quadratic in the body length.\n\nFor example, a 1 MiB url encoded body consisting of `a;` repeated ~500,000 times, submitted with `Content-Type: application/x-www-form-urlencoded`, causes the parser to perform on the order of 10^11 byte comparisons, consuming several seconds of CPU for a single request. Cost scales quadratically with chunk size.\n\nThe parser is reachable through the public `QuerystringParser` class and through the high level `FormParser`, `create_form_parser`, and `parse_form` APIs for url encoded bodies. It is also the parser Starlette and FastAPI use for `application/x-www-form-urlencoded` request bodies via `request.form()`.\n\n### Impact\n\nUncontrolled CPU consumption (denial of service). Parsing is synchronous, so a single small crafted form body occupies the handling worker for seconds, blocking any other work on that worker until parsing finishes. Sustained concurrent requests keep workers continuously busy, degrading or denying service.\n\n### Mitigation\n\nUpgrade to `python-multipart` `0.0.30` or later, which treats only `\u0026` as a field separator (per the [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing)) using a single bounded scan, making parsing linear in the body length.","status":"published","published":"2026-06-15T20:24:09Z","modified":"2026-06-15T20:24:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-53539","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T18:16:44.36Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-53539","title":"Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T16:55:42.787Z","modified":"2026-10-28T02:30:30.246551125Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-53539","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T18:16:44.36Z","modified":"2026-10-26T11:47:27.630230932Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-5rvq-cxj2-64vf","title":"python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","description":"### Summary\n\nWhen parsing `application/x-www-form-urlencoded` bodies, `QuerystringParser` located the field separator with a two step lookup: it first scanned the entire remaining buffer for `\u0026`, and only when no `\u0026` existed anywhere ahead did it fall back to scanning for `;`. For a body that uses `;` as the separator and contains no `\u0026`, every field iteration performed a full failed `\u0026` scan over the entire remaining buffer before locating the nearby `;`. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk.\n\nAn attacker can submit a small crafted body of the form `a;a;a;...` and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes.\n\n### Details\n\nIn `python_multipart/multipart.py`, both the `FIELD_NAME` and `FIELD_DATA` states located the next separator like this:\n\n```python\nsep_pos = data.find(b\"\u0026\", i)\nif sep_pos == -1:\n    sep_pos = data.find(b\";\", i)\n```\n\n`data.find(b\"\u0026\", i)` scans from `i` to the end of the buffer and returns `-1` only when there is no `\u0026` anywhere in the remainder. For a `;` separated body with no `\u0026`, this failed full buffer scan repeats once per field, making parsing quadratic in the body length.\n\nFor example, a 1 MiB url encoded body consisting of `a;` repeated ~500,000 times, submitted with `Content-Type: application/x-www-form-urlencoded`, causes the parser to perform on the order of 10^11 byte comparisons, consuming several seconds of CPU for a single request. Cost scales quadratically with chunk size.\n\nThe parser is reachable through the public `QuerystringParser` class and through the high level `FormParser`, `create_form_parser`, and `parse_form` APIs for url encoded bodies. It is also the parser Starlette and FastAPI use for `application/x-www-form-urlencoded` request bodies via `request.form()`.\n\n### Impact\n\nUncontrolled CPU consumption (denial of service). Parsing is synchronous, so a single small crafted form body occupies the handling worker for seconds, blocking any other work on that worker until parsing finishes. Sustained concurrent requests keep workers continuously busy, degrading or denying service.\n\n### Mitigation\n\nUpgrade to `python-multipart` `0.0.30` or later, which treats only `\u0026` as a field separator (per the [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing)) using a single bounded scan, making parsing linear in the body length.","status":"published","published":"2026-06-15T20:24:09Z","modified":"2026-09-10T03:50:48.426087467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"PYSEC-2026-3036","title":"python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","description":"### Summary\n\nWhen parsing `application/x-www-form-urlencoded` bodies, `QuerystringParser` located the field separator with a two step lookup: it first scanned the entire remaining buffer for `\u0026`, and only when no `\u0026` existed anywhere ahead did it fall back to scanning for `;`. For a body that uses `;` as the separator and contains no `\u0026`, every field iteration performed a full failed `\u0026` scan over the entire remaining buffer before locating the nearby `;`. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk.\n\nAn attacker can submit a small crafted body of the form `a;a;a;...` and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes.\n\n### Details\n\nIn `python_multipart/multipart.py`, both the `FIELD_NAME` and `FIELD_DATA` states located the next separator like this:\n\n```python\nsep_pos = data.find(b\"\u0026\", i)\nif sep_pos == -1:\n    sep_pos = data.find(b\";\", i)\n```\n\n`data.find(b\"\u0026\", i)` scans from `i` to the end of the buffer and returns `-1` only when there is no `\u0026` anywhere in the remainder. For a `;` separated body with no `\u0026`, this failed full buffer scan repeats once per field, making parsing quadratic in the body length.\n\nFor example, a 1 MiB url encoded body consisting of `a;` repeated ~500,000 times, submitted with `Content-Type: application/x-www-form-urlencoded`, causes the parser to perform on the order of 10^11 byte comparisons, consuming several seconds of CPU for a single request. Cost scales quadratically with chunk size.\n\nThe parser is reachable through the public `QuerystringParser` class and through the high level `FormParser`, `create_form_parser`, and `parse_form` APIs for url encoded bodies. It is also the parser Starlette and FastAPI use for `application/x-www-form-urlencoded` request bodies via `request.form()`.\n\n### Impact\n\nUncontrolled CPU consumption (denial of service). Parsing is synchronous, so a single small crafted form body occupies the handling worker for seconds, blocking any other work on that worker until parsing finishes. Sustained concurrent requests keep workers continuously busy, degrading or denying service.\n\n### Mitigation\n\nUpgrade to `python-multipart` `0.0.30` or later, which treats only `\u0026` as a field separator (per the [WHATWG URL standard](https://url.spec.whatwg.org/#urlencoded-parsing)) using a single bounded scan, making parsing linear in the body length.","status":"published","published":"2026-07-13T15:46:17.36414Z","modified":"2026-07-13T16:33:29.036422056Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"RHLW-2026-49c9d6d5f43496cc","title":"Lightwell Security Advisory: python-multipart 0.0.27+rhlw.1","description":"Red Hat Lightwell has released python-multipart 0.0.27+rhlw.1 with a backported security fix.\n\nCVE-2026-53539: Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service\n\nThis patched artifact is a drop-in replacement for python-multipart 0.0.27 from PyPI.","status":"published","published":"2026-11-06T14:28:38Z","modified":"2026-11-06T19:30:02.716681387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"RHLW-2026-5412f98f0e0f6e5e","title":"Lightwell Security Advisory: python-multipart 0.0.29+rhlw.1","description":"Red Hat Lightwell has released python-multipart 0.0.29+rhlw.1 with a backported security fix.\n\nCVE-2026-53539: Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service\n\nThis patched artifact is a drop-in replacement for python-multipart 0.0.29 from PyPI.","status":"published","published":"2026-11-09T03:35:48Z","modified":"2026-11-10T08:30:02.384992215Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T08:55:24.395105Z"},{"id":"RHLW-2026-bb458408b595d6af","title":"Lightwell Security Advisory: python-multipart 0.0.28+rhlw.1","description":"Red Hat Lightwell has released python-multipart 0.0.28+rhlw.1 with a backported security fix.\n\nCVE-2026-53539: Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service\n\nThis patched artifact is a drop-in replacement for python-multipart 0.0.28 from PyPI.","status":"published","published":"2026-11-06T14:23:30Z","modified":"2026-11-06T19:30:03.66584112Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"UBUNTU-CVE-2026-53539","description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.","status":"published","published":"2026-06-22T18:16:00Z","modified":"2026-10-17T13:00:25.312916418Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"openSUSE-SU-2026:21066-1","title":"Security update for python-python-multipart","description":"This update for python-python-multipart fixes the following issues\n\n- CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling (bsc#1268506).\n- CVE-2026-53538: urlencoded requests containing semicolons can lead to form field smuggling (bsc#1268496).\n- CVE-2026-53539: small crafted body can cause a denial of service (bsc#1268500).\n- CVE-2026-53540: crafted request buffers can lead to degrading availability (bsc#1268488).\n","status":"published","published":"2026-06-26T07:58:44Z","modified":"2026-06-30T18:24:38.453792818Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-PYPI-CVE-2026-53539","title":"CVE-2026-53539 in python-multipart - Patched by Root","description":"Root has patched CVE-2026-53539 in the python-multipart package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-09-14T08:55:54Z","modified":"2026-09-14T09:15:04.228598592Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2026:22372-1","title":"Security update for python-python-multipart","description":"This update for python-python-multipart fixes the following issues\n\n- CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling (bsc#1268506).\n- CVE-2026-53538: urlencoded requests containing semicolons can lead to form field smuggling (bsc#1268496).\n- CVE-2026-53539: small crafted body can cause a denial of service (bsc#1268500).\n- CVE-2026-53540: crafted request buffers can lead to degrading availability (bsc#1268488).\n","status":"published","published":"2026-06-26T07:58:40Z","modified":"2026-07-02T18:24:14.95877653Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}