CVE-2026-53538: fastapiexpert python-multipart Interpretation Conflict

Vulnerability summary

CVE-2026-53538 is a low (CVSS 3.7) Interpretation Conflict vulnerability in fastapiexpert python-multipart. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.1% of scored vulnerabilities.

Timeline

1. 22-06-2026
   PublishedVulnerability first disclosed.
2. 23-06-2026
   Last modifiedVulnerability information updated.

Description

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.

• CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.