https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:25:21 +0000 https://db.gcve.eu/vuln/cve-2026-53538 <p><strong>Affected:</strong> Kludex python-multipart</p> <p>Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &amp;. The WHATWG URL standard, modern browsers, and Python&#39;s urllib.parse (since the CVE-2021-23336 fix) treat only &amp; as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.</p> <p><strong>Affected:</strong> Kludex python-multipart</p> <p>Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &amp;. The WHATWG URL standard, modern browsers, and Python&#39;s urllib.parse (since the CVE-2021-23336 fix) treat only &amp; as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.</p> https://db.gcve.eu/vuln/cve-2026-53538