Описание
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.
A flaw was found in Python-Multipart, a streaming multipart parser. A remote attacker can exploit this vulnerability by submitting a specially crafted application/x-www-form-urlencoded body. This can cause the QuerystringParser to perform inefficient processing, leading to excessive CPU consumption. Consequently, a small number of concurrent requests can exhaust worker processes, resulting in a Denial of Service (DoS) for the affected system.
Отчет
A flaw was found in python-multipart. When parsing application/x-www-form-urlencoded bodies, QuerystringParser used a two-step separator lookup that scanned the entire remaining buffer for & before falling back to ;. For bodies using ; as the separator with no &, this yields O(B²) byte comparisons per chunk. An attacker can submit a small crafted body to cause the parser to spend seconds of CPU per request, exhausting worker processes with a handful of concurrent requests. This is the same root cause as CVE-2026-53538 (parser differential), both fixed in python-multipart 0.0.30.
Меры по смягчению последствий
Upgrade to python-multipart 0.0.30 or later, which treats only & as a field separator per the WHATWG URL standard. ; is parsed as ordinary field data, matching urllib.parse, browsers, and other compliant parsers. Deployments that enforce request body size limits, rate limiting, and load balancing make exploitation much harder.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | python-multipart | Fix deferred | ||
| Lightspeed Core | python-multipart | Not affected | ||
| Migration Toolkit for Applications 8 | python-multipart | Fix deferred | ||
| OpenShift Lightspeed | python-multipart | Fix deferred | ||
| Red Hat AI Inference Server | python-multipart | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | python-multipart | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | python-multipart | Fix deferred | ||
| Red Hat Enterprise Linux command line assistant | python-multipart | Not affected | ||
| Red Hat Hardened Images | jaeger | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | python-multipart | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.9 Medium
CVSS3
Связанные уязвимости
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.
Python-Multipart is a streaming multipart parser for Python. Prior to ...
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
5.9 Medium
CVSS3