CVE-2026-53538: python-multipart Parameter Smuggling Vulnerability
Summary
CVE-2026-53538: python-multipart: Semicolon treated as querystring field separator enables parameter smuggling. Affects python-multipart versions < 0.0.30. Fixed in 0.0.30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-multipart is a Python library used for parsing multipart/form-data, commonly utilized in web applications to handle file uploads and form submissions. It allows developers to easily manage and process incoming data from forms. However, a recent vulnerability has been identified that affects how this library interprets query string parameters, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises from the QuerystringParser in python-multipart treating semicolons (;) as field separators in application/x-www-form-urlencoded bodies, in addition to the standard ampersands (&). This behavior deviates from the WHATWG URL standard, which specifies that only ampersands should be used as separators. As a result, an attacker can exploit this discrepancy to smuggle additional or overriding form fields past security components that adhere to the WHATWG standard, leading to potential parameter pollution and unauthorized access to sensitive data.
How To Fix
Latest published version: 0.0.32 as of 23 Oct 2026
pip install --upgrade "python-multipart==0.0.32"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.30
This is the first release that contains the fix.
pip install --upgrade "python-multipart==0.0.30"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application validates and sanitizes incoming form data, particularly when using components that may not adhere to the WHATWG standard. However, the best solution is to upgrade to the patched version of the library.
Conclusion
The vulnerability identified as CVE-2026-53538 in the python-multipart library poses a significant risk due to improper handling of query string parameters. Upgrading to the latest version is crucial to ensure the security of applications using this library.
See every vulnerability recorded for python-multipart →
FAQ
The impact includes the potential for HTTP parameter pollution, allowing attackers to smuggle extra form fields past security checks, which could lead to unauthorized actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 3.7, indicating a moderate level of risk.
Yes, you should upgrade to python-multipart version 0.0.30 or later to mitigate this vulnerability.
If an immediate upgrade is not possible, implement strict validation and sanitization of incoming form data as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python-multipart.
