3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53538

CVE-2026-53538: python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53538

CVE-2026-53538:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
python-multipart	pip	< 0.0.30	0.0.30

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the vulnerability started by examining the provided description, which indicated that the QuerystringParser in python-multipart incorrectly used semicolons as field separators. The advisory pointed to version 0.0.30 as the patched version. By comparing the git tags for version 0.0.29 and 0.0.30 of the Kludex/python-multipart repository, I identified the commit d69df35cd2cad9c72794c2c340db646afae957d8 which explicitly states in its message "Treat only & as the urlencoded field separator". The diff of this commit clearly shows changes in the python_multipart/multipart.py file, specifically within the _internal_write method of the QuerystringParser class. The patch removes the logic that searched for semicolons as separators when parsing field names and data. This confirms that QuerystringParser._internal_write is the precise location of the vulnerable code. During exploitation, this function would be on the call stack as it processes the malicious URL-encoded body, making it a key runtime indicator.

Vulnerable functions

QuerystringParser._internal_write

python_multipart/multipart.py

The `_internal_write` method within the `QuerystringParser` class was responsible for parsing URL-encoded form data. The vulnerability existed because this method treated both ampersands ('&') and semicolons (';') as field separators. This behavior deviated from the WHATWG URL standard, which specifies that only '&' should be used as a separator. An attacker could craft a request like 'role=user&x=;role=admin' which an intermediary (like a WAF) might parse as two fields ('role=user' and 'x=;role=admin'), but the backend `python-multipart` application would parse as three fields ('role=user', 'x=', and 'role=admin'), potentially leading to a parameter smuggling vulnerability where the last 'role' parameter overrides the first.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.