CVE-2026-53538 Overview
CVE-2026-53538 affects python-multipart, a streaming multipart parser for Python applications. Versions prior to 0.0.30 contain a parser differential vulnerability in the QuerystringParser component. The parser treats the semicolon character (;) as a field separator in application/x-www-form-urlencoded bodies, in addition to the ampersand (&). The WHATWG URL standard, modern browsers, and Python's urllib.parse (after the CVE-2021-23336 fix) recognize only & as a valid separator. This inconsistency enables attackers to smuggle additional form fields past upstream body-inspecting components.
Critical Impact
An attacker can craft request bodies that are tokenized differently by python-multipart than by upstream WHATWG-compliant intermediaries, bypassing security controls that inspect form data.
Affected Products
- python-multipart versions prior to 0.0.30
- Python web applications and frameworks using the affected QuerystringParser
- Deployments where an upstream proxy or WAF inspects form bodies before they reach the parser
Discovery Timeline
- 2026-06-22 - CVE-2026-53538 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-53538
Vulnerability Analysis
The vulnerability is classified as an interpretation conflict between components ([CWE-436]). It is a parser differential, not a memory corruption or code execution issue. The attack vector is network-based and requires no authentication or user interaction, though exploitation complexity is high because it depends on the presence of an upstream inspecting intermediary.
A WHATWG-compliant intermediary parsing the body a=1&b=2 extracts two fields. The same intermediary parsing a=1;b=2 extracts a single field with value 1;b=2. The vulnerable python-multipart parser tokenizes a=1;b=2 into two distinct fields, splitting on the semicolon. This mismatch allows hidden fields to bypass inspection.
Root Cause
The root cause lies in QuerystringParser treating ; as an additional separator alongside &. This behavior reflects a legacy HTML 4.01 recommendation that was deprecated by the WHATWG URL Living Standard. Modern browsers and urllib.parse aligned with the WHATWG specification following the remediation of CVE-2021-23336. The lingering legacy behavior in python-multipart produced the parser differential.
Attack Vector
An attacker sends an HTTP POST request with a Content-Type of application/x-www-form-urlencoded containing semicolon-separated tokens. An upstream component, such as a WAF, API gateway, or proxy, parses the body using only & as a separator and sees one benign field. The downstream Python application using python-multipart parses the same bytes and extracts multiple fields, including attacker-controlled values that were never inspected by the upstream control.
The vulnerability manifests in the QuerystringParser tokenization logic. See the GitHub Security Advisory for technical details and a description of the fix in version 0.0.30.
Detection Methods for CVE-2026-53538
Indicators of Compromise
- HTTP POST requests with Content-Type: application/x-www-form-urlencoded containing semicolons (;) within the request body
- Discrepancies between fields logged by an upstream proxy or WAF and fields processed by the downstream Python application
- Application logs showing parsed form fields that were not present in upstream inspection logs
Detection Strategies
- Inventory deployed python-multipart versions across Python services and flag any version prior to 0.0.30
- Inspect HTTP access logs for application/x-www-form-urlencoded request bodies containing the ; character
- Compare field counts and names recorded by upstream inspection layers against fields processed by the application backend
Monitoring Recommendations
- Forward web server, WAF, and application logs to a centralized analytics platform to correlate request-body parsing differences
- Alert on unusual or unexpected form field names appearing in downstream application telemetry
- Track dependency manifests (requirements.txt, pyproject.toml, poetry.lock) for python-multipart versions during CI/CD pipelines
How to Mitigate CVE-2026-53538
Immediate Actions Required
- Upgrade python-multipart to version 0.0.30 or later in all affected applications
- Audit upstream WAF, proxy, and API gateway rules that depend on form-body inspection for security decisions
- Reject or normalize request bodies containing semicolons in application/x-www-form-urlencoded payloads at the perimeter
Patch Information
The maintainers fixed the issue in python-multipart version 0.0.30 by aligning QuerystringParser with the WHATWG URL standard, removing ; as a field separator. Refer to the GitHub Security Advisory GHSA-6jv3-5f52-599m for the official remediation guidance.
Workarounds
- Configure upstream inspection components to also treat ; as a separator, matching the legacy parser behavior, until patching completes
- Strip or reject semicolon characters from application/x-www-form-urlencoded request bodies at the WAF or reverse proxy
- Validate parsed form fields server-side against an allowlist of expected field names
# Configuration example
pip install --upgrade 'python-multipart>=0.0.30'
pip show python-multipart | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
