CVE-2026-53540: Python-Multipart Content-Length Validation Bypass (Denial of Service)

Technical summary

The vulnerability resides in the parse_form() function of Python-Multipart prior to 0.0.31. The function uses the Content-Length header to set bounds on how much data is read during chunked processing of multipart request bodies. The code does not validate that Content-Length is a non-negative integer before using it in read operations. When a negative Content-Length is provided, the read-until-EOF behavior is triggered, causing the entire unbounded request body to be loaded into memory in a single operation rather than in fixed-size chunks. This bypasses the intended chunked streaming design and creates a denial-of-service condition. The issue is classified under CWE-1284 (Improper Validation of Specified Type of Input).

Business impact

Applications using vulnerable versions of Python-Multipart are exposed to denial-of-service attacks that degrade availability. An unauthenticated attacker can send specially crafted form requests that consume excessive server memory, potentially rendering the application unresponsive. While the CVSS score is low (3.7), the practical impact on production systems depends on request rate limits, available memory, and whether the application handles out-of-memory conditions gracefully. For APIs that accept user-submitted forms without strict input validation upstream, this represents a real availability risk.

Affected systems

Python-Multipart versions prior to 0.0.31 are affected. The library is commonly used in FastAPI and other Python web frameworks that need to parse multipart form data and file uploads. Applications that depend on python-multipart indirectly through framework dependencies should be checked, as the vulnerable library may be pulled in transitively. FastAPI users and other frameworks using this parser for form handling are in scope.

Exploitability

Exploitation requires only network access and the ability to send HTTP requests with custom headers—no authentication is needed. The attack is deterministic: sending a single malformed request with a negative Content-Length header will trigger the vulnerability. However, the CVSS vector (AC:H) indicates that attack complexity is considered high, likely because the practical impact depends on server resource availability and application architecture. Exploitation does not require user interaction and can be delivered over the network without special privileges.

Remediation

Upgrade python-multipart to version 0.0.31 or later. This patch version includes validation of the Content-Length header, ensuring only non-negative values are accepted. Organizations should prioritize updating this dependency in environments where user-uploaded forms or multipart requests are processed. Verify the patch through the official repository and release notes to confirm the fix addresses this specific validation issue.

Patch guidance

Update python-multipart to 0.0.31 or later via your package manager (pip: pip install --upgrade python-multipart). If using a framework like FastAPI that depends on python-multipart indirectly, ensure your framework's dependency lock file or requirements include the patched version. Test form submission and file upload functionality after patching to confirm normal operation. No breaking changes are expected from this patch, as it only adds validation that should reject invalid input.

Detection guidance

Monitor application logs for requests containing unusual or negative Content-Length header values in multipart form submissions. Watch for sudden spikes in memory consumption coinciding with form POST requests. If running with memory limits or containerized environments, look for out-of-memory exceptions or process kills during form processing. Network-based detection could identify requests with Content-Length header values that parse as negative integers. Application-level monitoring of request processing time and memory allocation during form parsing may reveal attempts to exhaust memory.

Why prioritize this

This vulnerability should be addressed as part of regular patching cycles for dependencies used in form and file handling. While the CVSS score is low and it is not tracked in CISA's KEV catalog, the simplicity of exploitation and potential to disrupt production services justifies timely remediation. Prioritize environments that accept untrusted form input from external users or APIs. Organizations with strict availability requirements or those operating in resource-constrained environments should move this higher in their patch queue.

Risk score, explained

The CVSS 3.1 score of 3.7 (LOW severity) reflects a network-accessible vulnerability with low complexity to execute, resulting in limited availability impact (A:L). The score does not account for the deterministic nature of the attack or its potential cumulative effect in high-traffic scenarios. The lack of confidentiality or integrity impact limits the overall severity. However, the gap between CVSS score and practical risk is notable: a single unauthenticated attacker can reliably trigger memory exhaustion, making real-world business impact potentially higher than the numeric score suggests.

Frequently asked questions