CVE catalog

CVE-2026-53537

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently

[CVE catalog]

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 §4.2 explicitly forbids the filename* form in multipart/form-data. Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for multipart/form-data (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend. This vulnerability is fixed in 0.0.30.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-multipartsid0.0.32-1fixed
Debianpython-multipartforky0.0.32-1fixed
Debianpython-multiparttrixie0.0.20-1.1~deb13u1vulnerable
Debianpython-multipartbookworm0.0.5-3not affected
Cpepython-multipartNot reported0.0.30fixed
PyPIpython-multipartNot reported0.0.30fixed
Susepython-python-multipartlinux enterprise server 16.00.0.20-160000.5.1fixed
Susepython-python-multipartlinux enterprise server for sap applications 16.00.0.20-160000.5.1fixed
Opensusepython-python-multipartleap 16.00.0.20-160000.5.1fixed
Opensusepython-python-multiparttumbleweed0.0.32-1.1fixed
Cpepython-multipartNot reported0.0.30fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-multipartsourcesid0.0.32-1not yet assignedNot reported[1140628]
Debianpython-multipartsourceforky0.0.32-1not yet assignedNot reported[1140628]
Debianpython-multipartsourcetrixie(unfixed)not yet assignedNot reported[1140628]
Debianpython-multipartsourcebookwormNot affectedunimportantNot reported[1140628]
Cpepython-multipartcpeNot reported0.0.30Not reportedNot reportedNot reported
PyPIpython-multipartPyPINot reported0.0.30Not reportedGHSA-VFFW-93WF-4J4QNot reported
Susepython-python-multipartrpmlinux enterprise server 16.00.0.20-160000.5.1Not reportedSUSE-SU-2026:22372-1Not reported
Susepython-python-multipartrpmlinux enterprise server for sap applications 16.00.0.20-160000.5.1Not reportedSUSE-SU-2026:22372-1Not reported
Opensusepython-python-multipartrpmleap 16.00.0.20-160000.5.1Not reportedOPENSUSE-SU-2026:21066-1Not reported
Opensusepython-python-multipartrpmtumbleweed0.0.32-1.1Not reportedOPENSUSE-SU-2026:11099-1Not reported
Cpepython-multipartcpeNot reported0.0.30Not reportedNVD-CVE-2026-53537Not reported

[Debian bug #1140628]

Notes

[trixie] python-multipart: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [python3-python-multipart]Affected

    Source package: [python-multipart]

    Details (2)

    • 0.0.20-1.1~deb13u1 · all · trixie

      Affected

      nvd · python-multipart · debian · 13

    • 0.0.20-1.1~deb13u1 · all · trixie

      Affected

      nvd · python-multipart · debian · 13

[openSUSE Tumbleweed]

[Debian 12 (Bookworm)]

  • [python3-multipart]Not affected

    Source package: [python-multipart]

    Details (2)

    • 0.0.5-3 · all · bookworm

      Not affected

      nvd · python-multipart · debian · bookworm

    • 0.0.5-3 · all · bookworm

      Not affected

      nvd · python-multipart · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]