Pypi · Python-Multipart · CVE-2026-53540
**Name of the Vulnerable Software and Affected Versions**
Python-Multipart versions prior to 0.0.31
**Description**
The `parse form()` function fails to validate the `Content-Length` header before using it to limit the chunked read of the request body. Because the header value is parsed as an integer without a sign check, a negative `Content-Length` (such as `-1`) causes the `input stream.read()` operation to read until the end of the stream (EOF). This results in the entire request body being loaded into memory in a single unbounded read instead of fixed-size chunks, which can degrade system availability under concurrent requests.
**Recommendations**
Update to version 0.0.31 or later.