# python-multipart (PyPI) vulnerabilities

9 known vulnerabilities (5 high, 1 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 0.0.33 (Oct 31, 2026): no advisory affects it
- Newest unaffected release: 0.0.33 (Oct 31, 2026), the latest release
- Weekly downloads: 108M
- Dependents: 43.6K
- Releases: 33 since 0.0.1 (Mar 26, 2013)
- Registry: https://pypi.org/project/python-multipart/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-53540: 0.0.1 to 0.0.30 (0.0.31 is outside it)
- CVE-2026-53537: 0.0.1 to 0.0.29 (0.0.30 is outside it)
- CVE-2026-53538: 0.0.1 to 0.0.29 (0.0.30 is outside it)
- CVE-2026-53539: 0.0.1 to 0.0.29 (0.0.30 is outside it)
- CVE-2026-42561: 0.0.1 to 0.0.26 (0.0.27 is outside it)
- CVE-2026-40347: 0.0.1 to 0.0.25 (0.0.26 is outside it)
- CVE-2026-24486: 0.0.1 to 0.0.21 (0.0.22 is outside it)
- CVE-2024-53981: 0.0.1 to 0.0.17 (0.0.18 is outside it)
- CVE-2024-24762: 0.0.1 to 0.0.6 (0.0.7 is outside it)

## Advisories (9)

### [CVE-2026-53540](https://cve.now/CVE-2026-53540): Python-Multipart: Negative Content-Length in parse\_form buffers the entire body in memory

- Severity: Low 3.7
- Published: Jun 22, 2026
- Affected: fixed in 0.0.31.
- Fixed in 0.0.31 (released Jun 4, 2026, 18 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2026-53537](https://cve.now/CVE-2026-53537): Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

- Severity: Low 3.7
- Published: Jun 22, 2026
- Affected: fixed in 0.0.30.
- Fixed in 0.0.30 (released May 31, 2026, 22 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2026-53538](https://cve.now/CVE-2026-53538): Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling

- Severity: Low 3.7
- Published: Jun 22, 2026
- Affected: fixed in 0.0.30.
- Fixed in 0.0.30 (released May 31, 2026, 22 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2026-53539](https://cve.now/CVE-2026-53539): Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

- Severity: High 7.5
- Published: Jun 22, 2026
- Affected: fixed in 0.0.30.
- Fixed in 0.0.30 (released May 31, 2026, 22 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2026-42561](https://cve.now/CVE-2026-42561): Python-Multipart: Denial of Service via unbounded multipart part headers

- Severity: High 7.5
- Published: May 13, 2026
- Affected: fixed in 0.0.27.
- Fixed in 0.0.27 (released Apr 27, 2026, 16 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2026-40347](https://cve.now/CVE-2026-40347): Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data

- Severity: Medium 5.3
- Published: Apr 17, 2026
- Affected: fixed in 0.0.26.
- Fixed in 0.0.26 (released Apr 10, 2026, 7 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2026-24486](https://cve.now/CVE-2026-24486): Python-Multipart has Arbitrary File Write via Non-Default Configuration

- Severity: High 8.6
- Published: Jan 27, 2026
- Affected: fixed in 0.0.22.
- Fixed in 0.0.22 (released Jan 25, 2026, 2 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2024-53981](https://cve.now/CVE-2024-53981): python-multipart has a Denial of service (DoS) via deformation \`multipart/form-data\` boundary

- Severity: High 7.5
- Published: Dec 2, 2024
- Affected: fixed in 0.0.18.
- Fixed in 0.0.18 (released Nov 28, 2024, 4 days before disclosure).
- The latest release, 0.0.33, is not affected.

### [CVE-2024-24762](https://cve.now/CVE-2024-24762): python-multipart vulnerable to content-type header Regular expression Denial of Service

- Severity: High 7.5
- Published: Feb 5, 2024
- Affected: fixed in 0.0.7.
- Fixed in 0.0.7 (released Feb 3, 2024, 2 days before disclosure).
- The latest release, 0.0.33, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/python-multipart
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.