Python-Multipart contains a quadratic-time querystring parsing bug that is triggered when a body uses semicolons as separators and contains no ampersands. Each field causes an exhaustive scan for ampersands before finding a semicolon, resulting in O(B²) comparisons for a body of size B. An attacker can craft a short body like a;a;a;… to force the parser to spend seconds of CPU per request, potentially exhausting server resources. This flaw provides a denial‑of‑service vulnerability by exhausting CPU cycles of the application, with no direct exploitation of confidentiality or integrity.

Kludex:python-multipart, all versions prior to 0.0.30. The vulnerability is patched in 0.0.30 and later releases.

The CVSS score of 7.5 indicates a high impact through remote exploitation. No EPSS data is available, and the flaw is not listed in CISA KEV. The attack requires only a crafted HTTP request body using semicolons, which can be sent by any external host. Multiple concurrent requests can saturate worker processes, leading to service degradation. No privileged access is needed and the vulnerability can be leveraged from outside the network if the endpoint remains exposed.