Threats tagged 'brew-gptme-cve-2026-53538'

The python-multipart library's QuerystringParser incorrectly treats the semicolon (';') as a field separator in application/x-www-form-urlencoded bodies, contrary to the WHATWG URL standard which uses only the ampersand ('&'). This discrepancy allows attackers to smuggle additional or overriding form fields past intermediaries that follow the standard, potentially causing parameter pollution. The issue affects versions from 0.28.0 up to but not including 0.31.0_12. A fix is available in version 0.31.0_12 and later.