By vendor

Fastapiexpert vulnerabilities

Known CVEs affecting Fastapiexpert products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-53539HIGH 7.5

  Python-Multipart, a popular library for parsing multipart form data in Python applications, contains a performance flaw that allows attackers to cause denial-of-service by sending specially crafted form submissions. When processing form data that uses semicolons as field separators, the parser inefficiently scans the entire remaining buffer for ampersands before falling back to semicolon detection. An attacker exploiting this flaw can send requests with many semicolon-separated fields that cause the parser to consume excessive CPU time, potentially exhausting server resources and degrading service for legitimate users.

• CVE-2026-53537LOW 3.7

  Python-Multipart before version 0.0.30 contains a header parsing vulnerability that could allow an attacker to bypass security controls. The library uses email message parsing for Content-Disposition and Content-Type headers, which automatically decodes RFC 2231/5987 extended parameter syntax (like filename*=). This decoding is not supposed to happen in multipart form data per the relevant RFC standard. An attacker can craft a specially formatted header that gets decoded differently by the vulnerable library than by upstream security tools (WAFs, proxies), potentially smuggling through a different field name or filename than inspectors expect. The risk is relatively low because successful exploitation requires specific conditions and produces only minor integrity issues, not data exposure or system unavailability.

• CVE-2026-53538LOW 3.7

  Python-Multipart versions before 0.0.30 contain a parser differential vulnerability in how they handle form-encoded data. The library treats semicolons (;) as field separators in form submissions, while modern standards—including web browsers and Python's built-in URL parser—only recognize ampersands (&) as separators. An attacker can exploit this mismatch to inject additional form fields that bypass security inspections performed by upstream components, such as web application firewalls or input validators. The attacker doesn't need special privileges or user interaction, though the attack requires specific conditions to trigger successfully.

• CVE-2026-53540LOW 3.7

  Python-Multipart, a streaming multipart parser library, contains a vulnerability in how it handles the Content-Length header when parsing form submissions. Before version 0.0.31, the parser fails to validate whether the Content-Length value is valid. An attacker who can send a request with a negative Content-Length header can force the parser to read the entire request body into memory at once, rather than processing it in manageable chunks. This memory exhaustion condition can cause the application to become unresponsive or crash.