CVE-2026-53540
Low
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
SeverityLow
CVSS3.7
Exploit probability—
ProductFastapiexpert Python-multipart
PublishedJun 22, 2026
First seenJun 22, 2026
Weakness typeCWE-1284CWE-1284
How to fix
Update
- fastapiexpert python-multipart0.0.31 or later
- python-multipart0.0.31 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fastapiexpert python-multipart | v < 0.0.31 | 0.0.31 |
| python-multipartPyPI | v < 0.0.31 | 0.0.31 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.