Threats tagged 'brew-mcp-proxy-cve-2026-53539'

A vulnerability in python-multipart's QuerystringParser causes quadratic-time parsing of application/x-www-form-urlencoded bodies that use semicolon separators. This leads to excessive CPU consumption and potential denial of service when processing crafted request bodies with many semicolon-separated fields. The issue affects versions from 0.8.2 up to but not including 0.12.0_2. The vulnerability is fixed in version 0.12.0_2 by changing the parser to only treat '&' as a field separator, making parsing linear in time.