RHLW-2026-49c9d6d5f43496cc: Lightwell Security Advisory: python-multipart 0.0.27+rhlw.1
Red Hat Lightwell has released python-multipart 0.0.27+rhlw.1 with a backported security fix.
CVE-2026-53539: Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
This patched artifact is a drop-in replacement for python-multipart 0.0.27 from PyPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/python-multipartto a version that resolves this vulnerability.Fixed in 0.0.27+rhlw.1 - Upgrade
Upgrade
python-multipartto a version that resolves this vulnerability.Fixed in 0.0.27+rhlw.1
Event History
Frequently Asked Questions
Which deployments are exposed to this CPU denial-of-service issue?
Deployments using python-multipart 0.0.27 are the relevant population identified by the advisory. The issue is in query-string parsing when semicolon separators are processed.
What input is needed to trigger the issue?
An attacker needs to provide a query string containing semicolon separators that causes quadratic-time parsing. The stated impact is CPU denial of service.
What should be deployed to remediate the issue?
Deploy python-multipart 0.0.27+rhlw.1, which includes a backported security fix. The advisory states that this artifact is a drop-in replacement for python-multipart 0.0.27 from PyPI.