CVE-2026-53540 Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
An attacker can cause memory exhaustion and denial of service by sending a request with a negative Content-Length header to applications using the vulnerable parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53540?
CVE-2026-53540 is a low-severity denial of service vulnerability in Kludex python-multipart, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.
Weakness: CWE-1284
Which versions are affected by CVE-2026-53540?
3 open source packages ship an affected version, including python-multipart. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-multipart PyPI | All versions | 0.0.31 |
python-multipart PyPI | All versions | 0.0.31 |
python-multipart PyPI | All versions | 0.0.31 |
Products include Fastapiexpert Python-Multipart.
How do I fix CVE-2026-53540?
Upgrade python-multipart to 0.0.31 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53540 being exploited?
There is no known exploitation of CVE-2026-53540 in the wild and no public exploit code.
Other vulnerabilities in Kludex python-multipart
- CVE-2026-24486 Python-Multipart has Arbitrary File Write via Non-Default Configuration
- CVE-2026-53539 Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
- CVE-2024-24762 python-multipart vulnerable to content-type header Regular expression Denial of Service
- CVE-2026-40347 Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
- CVE-2026-53537 Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Sources
Also known as CLEANSTART-2026-BI75805, CLEANSTART-2026-WK76849, CLSA-2026-1782781170, DEBIAN-CVE-2026-53540, ECHO-f040-8b65-1cc0, GHSA-v9pg-7xvm-68hf and 18 more.