RHLW-2026-bb458408b595d6af: Lightwell Security Advisory: python-multipart 0.0.28+rhlw.1

Q: What deployment scenario is exposed to this denial-of-service issue?

The issue affects use of python-multipart where attacker-controlled query strings are parsed and can contain semicolon separators. An attacker could supply input crafted to trigger quadratic-time parsing and consume CPU resources.

Q: What should teams do if they currently use python-multipart 0.0.28?

Replace it with Red Hat Lightwell's python-multipart 0.0.28+rhlw.1 artifact. The advisory states that this patched artifact is a drop-in replacement for python-multipart 0.0.28 from PyPI.

Published Nov 6, 2026

Updated

Red Hat Lightwell has released python-multipart 0.0.28+rhlw.1 with a backported security fix.

CVE-2026-53539: Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

This patched artifact is a drop-in replacement for python-multipart 0.0.28 from PyPI.

Affected Software

1 affected componentFixes available

red-hat-lightwell/python-multipart>=0.0.28<0.0.28+rhlw.1

0.0.28+rhlw.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/python-multipart to a version that resolves this vulnerability.
Fixed in 0.0.28+rhlw.1
Upgrade
Upgrade python-multipart to a version that resolves this vulnerability.
Fixed in 0.0.28+rhlw.1

Event History

Nov 6, 2026

Advisory Published

via OSV·02:23 PM

Data Sourced

via OSV·02:23 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What deployment scenario is exposed to this denial-of-service issue?

The issue affects use of python-multipart where attacker-controlled query strings are parsed and can contain semicolon separators. An attacker could supply input crafted to trigger quadratic-time parsing and consume CPU resources.

What should teams do if they currently use python-multipart 0.0.28?

Replace it with Red Hat Lightwell's python-multipart 0.0.28+rhlw.1 artifact. The advisory states that this patched artifact is a drop-in replacement for python-multipart 0.0.28 from PyPI.

RHLW-2026-bb458408b595d6af: Lightwell Security Advisory: python-multipart 0.0.28+rhlw.1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What deployment scenario is exposed to this denial-of-service issue?

What should teams do if they currently use python-multipart 0.0.28?

Company

Resources

Contact

Frequently Asked Questions

What deployment scenario is exposed to this denial-of-service issue?

What should teams do if they currently use python-multipart 0.0.28?