The python-multipart library before version 0.0.30 contains an uncontrolled resource consumption vulnerability (CWE-400) in its QuerystringParser. When parsing application/x-www-form-urlencoded bodies that use semicolon (;) as the separator and contain no ampersands (&), the parser repeatedly scans the entire remaining buffer for &, resulting in O(B^2) byte comparisons for a chunk of size B with N semicolon-separated fields. An attacker can exploit this by sending a crafted body with many semicolon-separated fields, causing high CPU usage and potential exhaustion of worker processes. This vulnerability was addressed and fixed in version 0.0.30.

The vulnerability allows an attacker to cause high CPU consumption on servers using vulnerable versions of python-multipart by submitting specially crafted request bodies. This can lead to denial of service by exhausting worker processes handling requests. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade python-multipart to version 0.0.30 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly confirmed beyond the fix in 0.0.30, so users should verify the upgrade.