PT-2026-49570 · Pypi · Python-Multipart
Published
2026-06-15
·
Updated
2026-06-15
·
CVE-2026-53538
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Summary
QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component.Details
In
python multipart/multipart.py, the FIELD NAME and FIELD DATA states located the next separator by scanning for & and, failing that, for ;:python
sep pos = data.find(b"&", i)
if sep pos == -1:
sep pos = data.find(b";", i)As a result,
; acted as a field boundary. Because the fallback only triggered when no & remained in the current chunk, tokenization also depended on unrelated bytes later in the buffer and on how the body was split across write() calls. This is the same class of issue as CVE-2021-23336 in CPython's urllib.parse.For example, a body inspecting WAF or gateway that follows the WHATWG rule (only
& separates fields) receives:role=user&x=;role=adminThe upstream parses two fields,
role=user and x=";role=admin", sees a benign role=user, and forwards the request. QuerystringParser parsed the same bytes as three fields: role="user", x="", and role="admin". The application (for example via Starlette/FastAPI request.form(), where the last value wins) then received role=admin, a value the upstream validator never saw.The parser is reachable through the public
QuerystringParser class, the high level FormParser, create form parser, and parse form APIs, and Starlette/FastAPI request.form() for url encoded bodies.Impact
Interpretation conflict / HTTP parameter pollution. An attacker can smuggle extra or overriding form fields past an upstream component that applies the WHATWG separator rule, reaching the backend with parameters the intermediary did not observe.
Mitigation
Upgrade to
python-multipart 0.0.30 or later, which treats only & as a field separator per the WHATWG URL standard. ; is parsed as ordinary field data, matching urllib.parse, browsers, and other compliant parsers.Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Python-Multipart