CVE-2026-53537: CWE-20: Improper Input Validation in Kludex python-multipart
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data. Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for multipart/form-data (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend. This vulnerability is fixed in 0.0.30.
AI Analysis
Technical Summary
The vulnerability in python-multipart (CVE-2026-53537) arises from improper input validation where Content-Disposition headers are parsed using RFC 2231/5987 decoding. This approach is non-compliant with RFC 7578 §4.2, which governs multipart/form-data encoding. As a result, attackers can craft multipart requests that bypass upstream inspection by smuggling modified field names or filenames, potentially leading to downstream processing issues. The vulnerability affects all versions prior to 0.0.30 and is fixed in version 0.0.30.
Potential Impact
The vulnerability has a low severity impact with a CVSS score of 3.7. It does not affect confidentiality or availability but allows limited integrity impact by enabling attackers to smuggle altered multipart field names or filenames past upstream inspection. This could lead to unexpected behavior or processing errors in backend systems relying on python-multipart for multipart/form-data parsing.
Mitigation Recommendations
A fix is available in python-multipart version 0.0.30. Users should upgrade to version 0.0.30 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-53537: CWE-20: Improper Input Validation in Kludex python-multipart
Description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data. Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for multipart/form-data (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend. This vulnerability is fixed in 0.0.30.
CVSS v3.1
Score 3.7low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in python-multipart (CVE-2026-53537) arises from improper input validation where Content-Disposition headers are parsed using RFC 2231/5987 decoding. This approach is non-compliant with RFC 7578 §4.2, which governs multipart/form-data encoding. As a result, attackers can craft multipart requests that bypass upstream inspection by smuggling modified field names or filenames, potentially leading to downstream processing issues. The vulnerability affects all versions prior to 0.0.30 and is fixed in version 0.0.30.
Potential Impact
The vulnerability has a low severity impact with a CVSS score of 3.7. It does not affect confidentiality or availability but allows limited integrity impact by enabling attackers to smuggle altered multipart field names or filenames past upstream inspection. This could lead to unexpected behavior or processing errors in backend systems relying on python-multipart for multipart/form-data parsing.
Mitigation Recommendations
A fix is available in python-multipart version 0.0.30. Users should upgrade to version 0.0.30 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T18:13:07.262Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a39735aeed863c81e39622d
Added to database: 06/22/2026, 17:39:38 UTC
Last enriched: 07/16/2026, 10:51:21 UTC
Last updated: 08/06/2026, 00:41:14 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.