CVE-2026-53540

Name of the Vulnerable Software and Affected Versions Python-Multipart versions prior to 0.0.31

Description The parse form() function fails to validate the Content-Length header before using it to limit the chunked read of the request body. Because the header value is parsed as an integer without a sign check, a negative Content-Length (such as -1) causes the input stream.read() operation to read until the end of the stream (EOF). This results in the entire request body being loaded into memory in a single unbounded read instead of fixed-size chunks, which can degrade system availability under concurrent requests.

Recommendations Update to version 0.0.31 or later.