CVE-2026-53538

Name of the Vulnerable Software and Affected Versions Python-Multipart versions prior to 0.0.30

Description The QuerystringParser treated the semicolon (;) as a field separator in application/x-www-form-urlencoded bodies, in addition to the ampersand (&). This deviates from the WHATWG URL standard, modern browsers, and Python's urllib.parse, which only recognize & as a separator. This discrepancy creates a parser differential, allowing an attacker to smuggle extra or overriding form fields past an upstream body inspecting component, such as a Web Application Firewall (WAF) or gateway, that follows the WHATWG rule. This can lead to interpretation conflicts or HTTP parameter pollution, where the backend application receives parameters that the intermediary validator did not observe.

Recommendations Update to version 0.0.30 or later.