CVE-2026-53539: Python-Multipart DOS Vulnerability

CVE-2026-53539 Overview

CVE-2026-53539 is an algorithmic complexity vulnerability in python-multipart, a streaming multipart parser widely used by Python web frameworks such as Starlette and FastAPI. The flaw resides in the QuerystringParser component when processing application/x-www-form-urlencoded request bodies. Versions prior to 0.0.30 perform a two-step separator lookup that scans the entire remaining buffer for & before falling back to ;, producing quadratic O(B^2) runtime behavior on crafted inputs. An unauthenticated remote attacker can submit a small body using ; as the field separator to consume seconds of CPU per request and exhaust worker processes [CWE-400]. The vulnerability is fixed in python-multipart version 0.0.30.

Critical Impact
A handful of concurrent requests containing semicolon-separated form bodies can exhaust application worker processes and cause denial of service.

Affected Products

python-multipart versions prior to 0.0.30
Python web applications that accept application/x-www-form-urlencoded request bodies through python-multipart
Downstream frameworks bundling vulnerable versions, including Starlette and FastAPI deployments

Discovery Timeline

2026-06-22 - CVE-2026-53539 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-53539

Vulnerability Analysis

The vulnerability is an algorithmic complexity denial-of-service condition in the QuerystringParser class. When parsing URL-encoded form bodies, the parser must locate the next field separator within the streaming buffer. The implementation prioritizes & over ; by performing two sequential linear scans across the remaining buffer.

For each field iteration, the parser first scans the entire remaining buffer searching for &. Only after this scan fails does it fall back to searching for ;. When the body contains only ; separators, every iteration performs a full failed & scan before locating the nearby ; character.

With N semicolon-separated fields in a buffer of size B, this pattern yields O(B^2) byte comparisons per chunk. A compact request body of the form a;a;a;... forces the parser into worst-case quadratic behavior.

Root Cause

The root cause is the two-step separator lookup strategy that scans the entire remaining buffer for the primary separator before falling back. The parser does not perform a single combined scan for both delimiters, nor does it bound the work performed per field. This design assumption fails when an input contains only the fallback separator.

Attack Vector

The attack vector is network-based, requires no authentication, and requires no user interaction. An attacker sends an HTTP request to any endpoint that triggers python-multipart URL-encoded body parsing. The body consists of repeated single-character fields separated by semicolons. A small payload measured in kilobytes is sufficient to consume seconds of CPU. Sustaining a low rate of concurrent requests starves worker processes and renders the application unresponsive. Refer to the GitHub Security Advisory GHSA-5rvq-cxj2-64vf for technical details.

Detection Methods for CVE-2026-53539

Indicators of Compromise

HTTP POST or PUT requests with Content-Type: application/x-www-form-urlencoded containing bodies composed primarily of ; delimiters and no & characters.
Sudden, sustained CPU saturation on Python application workers correlated with form-encoded request traffic.
Worker process timeouts, request queue backlogs, or 502/503 errors from upstream load balancers during low request volume.

Detection Strategies

Inspect web access logs and WAF telemetry for application/x-www-form-urlencoded request bodies with a high ratio of ; characters and an absence of & characters.
Profile Python workers to identify time spent inside python_multipart.multipart.QuerystringParser during anomalous CPU events.
Correlate request size against CPU consumption per request to surface low-byte requests producing disproportionate processing time.

Monitoring Recommendations

Track per-request CPU time and parser latency for endpoints that accept form-encoded payloads.
Alert on concurrent worker saturation when inbound request rates remain within normal baselines.
Monitor installed python-multipart versions across application inventories and flag any release below 0.0.30.

How to Mitigate CVE-2026-53539

Immediate Actions Required

Upgrade python-multipart to version 0.0.30 or later across all Python services and container images.
Rebuild and redeploy any application that pins a vulnerable version transitively through Starlette, FastAPI, or other frameworks.
Add request body size limits at the reverse proxy or application layer to cap the maximum size of form-encoded payloads.

Patch Information

The maintainers fixed the issue in python-multipart0.0.30. The remediation eliminates the redundant full-buffer scan for & before falling back to ;. Patch details and the full advisory are available in the GitHub Security Advisory GHSA-5rvq-cxj2-64vf.

Workarounds

Reject or strip application/x-www-form-urlencoded bodies that contain ; separators at a WAF or middleware layer until patching is complete.
Enforce strict request body size limits and per-request CPU timeouts on application workers.
Restrict endpoints that accept form-encoded input to authenticated clients where business logic allows.

bash

# Upgrade python-multipart to the patched release
pip install --upgrade 'python-multipart>=0.0.30'

# Verify the installed version
python -c "import python_multipart; print(python_multipart.__version__)"