Kludex python-multipart up to 0.0.29 on Python input validation

Summaryinfo

A vulnerability marked as problematic has been reported in Kludex python-multipart up to 0.0.29 on Python. Affected by this issue is some unknown functionality. Performing a manipulation results in input validation. This vulnerability is reported as CVE-2026-53537. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Kludex python-multipart up to 0.0.29 on Python. This affects an unknown code. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity. The summary by CVE is:

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data. Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for multipart/form-data (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend. This vulnerability is fixed in 0.0.30.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-53537 since 06/09/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.0.30 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Kludex

Name

• python-multipart

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12
• 0.0.13
• 0.0.14
• 0.0.15
• 0.0.16
• 0.0.17
• 0.0.18
• 0.0.19
• 0.0.20
• 0.0.21
• 0.0.22
• 0.0.23
• 0.0.24
• 0.0.25
• 0.0.26
• 0.0.27
• 0.0.28
• 0.0.29

Website

• Product: https://github.com/Kludex/python-multipart/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion