Threats tagged 'brew-mcp-proxy-cve-2026-53538'

The python-multipart library's QuerystringParser incorrectly treats the semicolon (';') as a field separator in application/x-www-form-urlencoded bodies, contrary to the WHATWG URL standard which only recognizes '&' as a separator. This discrepancy allows HTTP parameter smuggling, where an attacker can bypass upstream body inspection by injecting extra or overriding form fields that the intermediary does not detect but the backend processes. The issue affects versions from 0.8.2 up to but not including 0.12.0_2 and is fixed in version 0.12.0_2.