Streaming Multipart Parser Vulnerability in Python-Multipart by Kludex

CVE-2026-53537

What is CVE-2026-53537?

A vulnerability exists in the Python-Multipart parser, where prior versions allow maliciously crafted Content-Disposition and Content-Type headers to be misinterpreted. Specifically, due to improper parsing methods before version 0.0.30, an attacker can exploit this flaw to bypass security measures in components adhering to RFC 7578. By leveraging differences in header interpretation, malicious actors might smuggle unintended data to the backend server, potentially leading to unauthorized actions or data exposure.

References