VAITP Dataset

← Back to the dataset

CVE-2026-53540

Negative Content-Length leads to DoS via memory exhaustion.

  • CVSS 3.7
  • CWE-1284
  • Resource Management
  • Remote

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.

CVE
CVE-2026-53540
CWE
CWE-1284
CVSS base score
3.7
Published
2026-06-22
OWASP
A04 Insecure Design
Orthogonal defect classification
Checking
Code defect classification
Missing Check
Category
Resource Management
Subcategory
Resource Exhaustion
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Affected component
Python-Multi
Fixed by upgrading
Yes

Solution

Upgrade `python-multipart` to version 0.0.31 or later.

Vulnerable code sample

import io

def parse_form(headers: dict, body_stream: io.BytesIO):
    """
    Represents the vulnerable logic from python-multipart < 0.0.31.
    It does not validate the Content-Length header.
    """
    try:
        # Get Content-Length from headers and convert to int.
        # The vulnerable code assumes this will be a valid, non-negative integer.
        content_length = int(headers.get('Content-Length', '0'))
    except ValueError:
        content_length = 0

    # THE VULNERABILITY:
    # If a negative 'Content-Length' (e.g., -1) is provided, the .read() method
    # on a file-like object in Python reads until the end of the stream (EOF).
    # This causes the entire request body to be loaded into memory at once,
    # leading to a potential Denial of Service (DoS).
    # A proper implementation would validate that content_length is not negative.
    data = body_stream.read(content_length)

    # In a real parser, this raw data would then be processed as multipart data.
    return data

Patched code sample

import io
import typing


def fixed_parser_logic(
    headers: typing.Dict[str, str],
    input_stream: typing.IO[bytes],
) -> None:
    """
    A simplified function demonstrating the fix.

    The vulnerability was that a negative 'content-length' would cause
    `input_stream.read(-1)`, reading the entire stream into memory.
    The fix is to validate that 'content-length' is a positive integer.
    """
    content_length_str = headers.get("content-length")

    if not content_length_str:
        return

    try:
        content_length = int(content_length_str)
    except ValueError:
        return

    # THE FIX: Ensure content_length is a positive number.
    # Before this check, a negative value would be passed to `input_stream.read()`,
    # causing it to read until the end of the file (EOF) instead of a fixed chunk.
    if content_length <= 0:
        return

    # If validation passes, it is now safe to read the specified number of bytes.
    data_chunk = input_stream.read(content_length)

    # In a real-world scenario, a multipart parser would process the data_chunk here.

Payload

POST /upload HTTP/1.1
Host: vulnerable-server.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: -1

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="largefile.dat"
Content-Type: application/octet-stream

[... A very large amount of data to exhaust server memory ...]

------WebKitFormBoundary7MA4YWxkTrZu0gW--

Cite this entry

@misc{vaitp:cve202653540,
  title        = {{Negative Content-Length leads to DoS via memory exhaustion.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-53540},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-53540/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::