The python-multipart library, used for streaming multipart parsing in Python, had a parsing inconsistency before version 0.0.30. Specifically, its QuerystringParser treated the semicolon character as a separator in application/x-www-form-urlencoded bodies, whereas the WHATWG URL standard and modern browsers treat only the ampersand as a separator. This mismatch creates a parser differential, allowing attackers to inject additional form fields that may bypass upstream inspection mechanisms. This vulnerability is identified as CWE-436 (Interpretation Conflict) and CWE-444 (Inconsistent Interpretation of HTTP Requests). The vulnerability is resolved in python-multipart version 0.0.30.

This vulnerability allows an attacker to smuggle extra form fields past upstream body inspection components due to inconsistent parsing of field separators. While it does not directly compromise confidentiality or availability, it can lead to integrity issues by enabling injection of unexpected form fields, potentially affecting application logic or security controls relying on accurate request parsing.

Upgrade python-multipart to version 0.0.30 or later, where the QuerystringParser no longer treats semicolon as a field separator, aligning with the WHATWG URL standard. No other mitigation is indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in 0.0.30.