RHLW-2026-5412f98f0e0f6e5e: Lightwell Security Advisory: python-multipart 0.0.29+rhlw.1
Red Hat Lightwell has released python-multipart 0.0.29+rhlw.1 with a backported security fix.
CVE-2026-53539: Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
This patched artifact is a drop-in replacement for python-multipart 0.0.29 from PyPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/python-multipartto a version that resolves this vulnerability.Fixed in 0.0.29+rhlw.1 - Upgrade
Upgrade
python-multipartto a version that resolves this vulnerability.Fixed in 0.0.29+rhlw.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is remotely exploitable with no privileges or user interaction required. An attacker would need to send crafted query-string input using semicolon separators that triggers quadratic-time parsing.
What is the impact of successful exploitation?
Successful exploitation can consume excessive CPU resources and cause a denial of service. The available scoring indicates no confidentiality or integrity impact.
What update is available?
Red Hat Lightwell released python-multipart 0.0.29+rhlw.1 with a backported fix for CVE-2026-53539. It is described as a drop-in replacement for python-multipart 0.0.29 from PyPI.