GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2026:22372-1

Vulnerability from csaf_suse - Published: 2026-06-26 07:58 - Updated: 2026-09-15 16:09
Summary
Security update for python-python-multipart
Severity
Important
Notes
Title of the patch: Security update for python-python-multipart
Description of the patch: This update for python-python-multipart fixes the following issues - CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling (bsc#1268506). - CVE-2026-53538: urlencoded requests containing semicolons can lead to form field smuggling (bsc#1268496). - CVE-2026-53539: small crafted body can cause a denial of service (bsc#1268500). - CVE-2026-53540: crafted request buffers can lead to degrading availability (bsc#1268488).
Patchnames: SUSE-SLES-16.0-1088
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-53537
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch —
Vendor Fix
Threats
Impact low
CVE-2026-53538
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 2 products, the same list as for CVE-2026-53537
Threats
Impact low
CVE-2026-53539
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2026-53537
Threats
Impact important
CVE-2026-53540
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 2 products, the same list as for CVE-2026-53537
Threats
Impact low
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-python-multipart",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-python-multipart fixes the following issues\n\n- CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling (bsc#1268506).\n- CVE-2026-53538: urlencoded requests containing semicolons can lead to form field smuggling (bsc#1268496).\n- CVE-2026-53539: small crafted body can cause a denial of service (bsc#1268500).\n- CVE-2026-53540: crafted request buffers can lead to degrading availability (bsc#1268488).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1088",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22372-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22372-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622372-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22372-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047767.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268488",
        "url": "https://bugzilla.suse.com/1268488"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268496",
        "url": "https://bugzilla.suse.com/1268496"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268500",
        "url": "https://bugzilla.suse.com/1268500"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268506",
        "url": "https://bugzilla.suse.com/1268506"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53537 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53537/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53538 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53538/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53539 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53539/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-53540 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-53540/"
      }
    ],
    "title": "Security update for python-python-multipart",
    "tracking": {
      "current_release_date": "2026-09-15T16:09:40Z",
      "generator": {
        "date": "2026-06-26T07:58:40Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22372-1",
      "initial_release_date": "2026-06-26T07:58:40Z",
      "revision_history": [
        {
          "date": "2026-06-26T07:58:40Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-15T16:09:40Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-python-multipart-0.0.20-160000.5.1.noarch",
                "product": {
                  "name": "python313-python-multipart-0.0.20-160000.5.1.noarch",
                  "product_id": "python313-python-multipart-0.0.20-160000.5.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-python-multipart-0.0.20-160000.5.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
        },
        "product_reference": "python313-python-multipart-0.0.20-160000.5.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-python-multipart-0.0.20-160000.5.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
        },
        "product_reference": "python313-python-multipart-0.0.20-160000.5.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53537",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53537"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset\u0027lang\u0027value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 4.2 explicitly forbids the filename* form in multipart/form-data. Components that follow RFC 7578, or that do not implement RFC 2231/5987 decoding for multipart/form-data (WAFs, proxies, gateways), may interpret such a header differently. An attacker can exploit that difference to smuggle a different field name or filename past an upstream inspector to the backend. This vulnerability is fixed in 0.0.30.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53537",
          "url": "https://www.suse.com/security/cve/CVE-2026-53537"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268506 for CVE-2026-53537",
          "url": "https://bugzilla.suse.com/1268506"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-26T07:58:40Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-53537"
    },
    {
      "cve": "CVE-2026-53538",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53538"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to \u0026. The WHATWG URL standard, modern browsers, and Python\u0027s urllib.parse (since the CVE-2021-23336 fix) treat only \u0026 as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53538",
          "url": "https://www.suse.com/security/cve/CVE-2026-53538"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268496 for CVE-2026-53538",
          "url": "https://bugzilla.suse.com/1268496"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-26T07:58:40Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-53538"
    },
    {
      "cve": "CVE-2026-53539",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53539"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for \u0026, and only when no \u0026 existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no \u0026, every field iteration performed a full failed \u0026 scan over the entire remaining buffer before locating the nearby ;. With N semicolon separated fields in a chunk of size B, this yields O(B^2) byte comparisons per chunk. An attacker can submit a small crafted body of the form a;a;a;... and cause the parser to spend seconds of CPU per request. A handful of concurrent requests can exhaust worker processes. This vulnerability is fixed in 0.0.30.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53539",
          "url": "https://www.suse.com/security/cve/CVE-2026-53539"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268500 for CVE-2026-53539",
          "url": "https://bugzilla.suse.com/1268500"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-26T07:58:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-53539"
    },
    {
      "cve": "CVE-2026-53540",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-53540"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-53540",
          "url": "https://www.suse.com/security/cve/CVE-2026-53540"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268488 for CVE-2026-53540",
          "url": "https://bugzilla.suse.com/1268488"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-python-multipart-0.0.20-160000.5.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-26T07:58:40Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-53540"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.