- Latest release
- 0.0.33 (Oct 31, 2026): no advisory affects it
- Newest unaffected release
- 0.0.33 (Oct 31, 2026), the latest release
- Advisories
- 9 · 5 high, 1 medium, 3 low
- Weekly downloads
- 108M
- Dependents
- 43.6K
- Releases
- 33 since 0.0.1 (Mar 26, 2013)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-53540Affects 0.0.1 to 0.0.30 (0.0.31 is outside it)
- CVE-2026-53537Affects 0.0.1 to 0.0.29 (0.0.30 is outside it)
- CVE-2026-53538Affects 0.0.1 to 0.0.29 (0.0.30 is outside it)
- CVE-2026-53539Affects 0.0.1 to 0.0.29 (0.0.30 is outside it)
- CVE-2026-42561Affects 0.0.1 to 0.0.26 (0.0.27 is outside it)
- CVE-2026-40347Affects 0.0.1 to 0.0.25 (0.0.26 is outside it)
- CVE-2026-24486Affects 0.0.1 to 0.0.21 (0.0.22 is outside it)
- CVE-2024-53981Affects 0.0.1 to 0.0.17 (0.0.18 is outside it)
- CVE-2024-24762Affects 0.0.1 to 0.0.6 (0.0.7 is outside it)
Advisories 9
- CVE-2026-53540Low 3.7
Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory
Affected: fixed in 0.0.31.
Fixed in 0.0.31 (released Jun 4, 2026, 18 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2026-53537Low 3.7
Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Affected: fixed in 0.0.30.
Fixed in 0.0.30 (released May 31, 2026, 22 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2026-53538Low 3.7
Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling
Affected: fixed in 0.0.30.
Fixed in 0.0.30 (released May 31, 2026, 22 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2026-53539High 7.5
Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Affected: fixed in 0.0.30.
Fixed in 0.0.30 (released May 31, 2026, 22 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2026-42561High 7.5
Python-Multipart: Denial of Service via unbounded multipart part headers
Affected: fixed in 0.0.27.
Fixed in 0.0.27 (released Apr 27, 2026, 16 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2026-40347Medium 5.3
Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data
Affected: fixed in 0.0.26.
Fixed in 0.0.26 (released Apr 10, 2026, 7 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2026-24486High 8.6
Python-Multipart has Arbitrary File Write via Non-Default Configuration
Affected: fixed in 0.0.22.
Fixed in 0.0.22 (released Jan 25, 2026, 2 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2024-53981High 7.5
python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary
Affected: fixed in 0.0.18.
Fixed in 0.0.18 (released Nov 28, 2024, 4 days before disclosure).
The latest release, 0.0.33, is not affected.
- CVE-2024-24762High 7.5
python-multipart vulnerable to content-type header Regular expression Denial of Service
Affected: fixed in 0.0.7.
Fixed in 0.0.7 (released Feb 3, 2024, 2 days before disclosure).
The latest release, 0.0.33, is not affected.