Kludex Python-multipart vulnerabilities

• fastapiexpert python-multipart Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service CVE-2026-53539 Fix available 7.5 HighJune 15, 2026
• fastapiexpert python-multipart Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory CVE-2026-53540 Fix available 3.7 LowJune 15, 2026
• fastapiexpert python-multipart Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling CVE-2026-53538 Fix available 3.7 LowJune 15, 2026
• fastapiexpert python-multipart Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters CVE-2026-53537 Fix available 3.7 LowJune 15, 2026
• kludex python-multipart, red hat exploit intelligence, openshift lightspeed +11 more +13 more Python-Multipart: Denial of Service via unbounded multipart part headers CVE-2026-42561 Fix available 7.5 HighMay 6, 2026
• fastapiexpert python-multipart Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data CVE-2026-40347 Fix available 5.3 MediumApril 15, 2026
• fastapiexpert python-multipart, red hat lightspeed core, openshift lightspeed +11 more +13 more Python-Multipart has Arbitrary File Write via Non-Default Configuration CVE-2026-24486 Public exploitFix available 8.6 HighJanuary 26, 2026
• kludex python-multipart python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary CVE-2024-53981 Fix available 7.5 HighDecember 2, 2024
• fastapiexpert python-multipart, encode starlette, tiangolo fastapi +2 more python-multipart vulnerable to content-type header Regular expression Denial of Service CVE-2024-24762 Fix available 7.5 HighFebruary 5, 2024