{"id":"CVE-2026-53540","aliases":["GHSA-v9pg-7xvm-68hf","PYSEC-2026-3040"],"title":"python-multipart: Negative Content-Length in parse_form buffers the entire body in memory","summary":"python-multipart: Negative Content-Length in parse_form buffers the entire body in memory","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"python-multipart","product":"python-multipart","ecosystem":"pip","affected":["python-multipart < 0.0.31"],"patched":["python-multipart 0.0.31"],"published":"2026-06-15","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:50.590441047Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-v9pg-7xvm-68hf","references":[{"url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf"},{"url":"https://github.com/Kludex/python-multipart"},{"url":"https://github.com/advisories/GHSA-v9pg-7xvm-68hf"}],"tags":["osv","pip","ghsa"],"epss":0.00342,"epssPercentile":0.27731,"cwe":["CWE-1284"],"ingestedAt":"2026-07-07T15:41:58.645Z","slug":"CVE-2026-53540","body":"## Overview\n\n### Summary\n\n`parse_form()` did not validate the `Content-Length` header before using it to bound its chunked read of the request body. A negative `Content-Length` turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks.\n\n### Details\n\n`parse_form()` reads the input stream in chunks, never reading more than the remaining `Content-Length` at a time. The per-chunk size is computed as `min(content_length - bytes_read, chunk_size)`. The header value was parsed to an integer without checking its sign, so a `Content-Length` of `-1` made this expression negative, and `input_stream.read(-1)` reads until end of stream. The intended bounded, chunked read therefore collapsed into a single unbounded read of the whole stream. The amount read is still bounded by what the client actually sends.\n\n### Impact\n\nThis only affects code that calls `parse_form()` directly with a `Content-Length` header taken from attacker-controlled input and without normalizing a negative value first. No known package is affected:\n\n* Starlette and FastAPI drive `MultipartParser` directly from the ASGI `receive()` stream and do not call `parse_form()`.\n* Known `parse_form()` consumers either do not forward `Content-Length` to it, recompute it from the already-read body, or run behind a layer (such as Werkzeug) that normalizes a negative `Content-Length` to `0`.\n\nThe realistic exposure is limited to bespoke WSGI or `http.server` handlers that forward raw client headers into `parse_form()`. In that case a crafted request buffers the body in memory at once, degrading availability under concurrent requests rather than causing a complete denial of service.\n\n### Mitigation\n\nUpgrade to version `0.0.31` or later, which rejects a negative `Content-Length` with a `ValueError` before reading the stream.\n\n## Affected packages\n\n- `python-multipart < 0.0.31`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `python-multipart 0.0.31`","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}