Performance Degradation in Python-Multipart Streaming Parser by Kludex
CVE-2026-53539

7.5HIGH

Key Information:

Vendor

Kludex

Status
Python-multipart
Vendor
CVE Published:
22 June 2026

What is CVE-2026-53539?

The Python-Multipart library, a streaming multipart parser for Python, exhibits a performance vulnerability in versions prior to 0.0.30. This issue arises during the parsing of application/x-www-form-urlencoded bodies. Specifically, the QuerystringParser uses an inefficient two-step lookup mechanism to locate field separators. When a crafted request with semicolon-separated fields is sent, the parser can experience significant CPU load, causing delays in handling requests. This performance degradation can lead to resource exhaustion, particularly under concurrent load, potentially affecting application stability. The vulnerability has been addressed in version 0.0.30, which optimizes the parsing strategy.

Affected Version(s)

python-multipart < 0.0.30

References

https://github.com/Kludex/python-multipart/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.