Maxisbey

The `QuerystringParser` treated the semicolon (`;`) as a field separator in `application/x-www-form-urlencoded` bodies, in addition to the ampersand (`&`). This deviates from the WHATWG URL standard, modern browsers, and Python's `urllib.parse`, which only recognize `&` as a separator. This discrepancy creates a parser differential, allowing an attacker to smuggle extra or overriding form fields past an upstream body inspecting component, such as a Web Application Firewall (WAF) or gateway, that follows the WHATWG rule. This can lead to interpretation conflicts or HTTP parameter pollution, where the backend application receives parameters that the intermediary validator did not observe.

A quadratic complexity issue exists when parsing `application/x-www-form-urlencoded` bodies. The `QuerystringParser` performs a two-step lookup for field separators, scanning the entire remaining buffer for `&` before falling back to `;`. If a body uses `;` as a separator and contains no `&`, every field iteration triggers a full failed scan of the remaining buffer, resulting in O(B^2) byte comparisons per chunk. An attacker can submit a crafted body consisting of repeated separators to cause excessive CPU consumption, which can exhaust worker processes and lead to a denial of service. This parser is accessible via the `QuerystringParser` class and the `FormParser`, `create form parser`, and `parse form` APIs, and is utilized by Starlette and FastAPI for `request.form()` calls.