CVE-2026-53538
LowAdvisory
Published 15 Jun 2026In the index since 6 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.7
- base score, highest
- EPSS
- 0.003
- 17th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 62
- of 17,781 indexed, latest versions
- Container images
- 68
- deployed by those charts
- Fix available
- 1 of 1
- affected package
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
Carried by container images the latest versions of 62 of 17,781 indexed charts deploy, on 68 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-multipartpypi | 0.0.5, 0.0.6, 0.0.9, 0.0.18+8 more | 0.0.30 | 68 |
- OSV records
- GHSA-6jv3-5f52-599m
- Also known as
- PYSEC-2026-3037
Charts affected
62 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| yetiosdfir-infrastructureVerified publisher | 1.0.5 | 1 of 4See more | 6,583 |
| home-assistantpascaliskeVerified publisher | 0.1.1 | 1 of 1See more | 4,749 |
| prefect-agentprefectVerified publisher | 2024.8.30163822 | 1 of 1See more | 5,451 |
| prompt-dbprompt-dbVerified publisher | 1.0.7 | 1 of 3See more | 3,332 |
| rhbk-neurofacerhbk-neurofaceVerified publisher | 1.0.0 | 1 of 4See more | 3,781 |
| matrix-stackrock8sVerified publisher | 0.8.1 | 1 of 7See more | 9,256 |
| checkmkrtomik-helm-chartsVerified publisher | 0.1.0 | 1 of 1See more | 7,436 |
| runwhen-localrunwhen-contribVerified publisher | 0.6.17 | 1 of 3See more | 3,707 |
| showroom-docs-mcpshowroom-docs-mcpVerified publisher | 2.1.0 | 1 of 4See more | 5,201 |
| mealiesmarthallVerified publisher | 0.0.10 | 1 of 1See more | 5,565 |
| srebotsrebot | 0.14.0 | 1 of 2See more | 1,542 |
| wazuhwazuh-helm-eksVerified publisher | 1.2.10 | 1 of 6See more | 5,484 |
Container images carrying it
68 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | c06aa0fa9a85 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 9a5a3eb4a213 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 067e54e2e107 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | cd25a5cc3f1b | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 379e31b8c751 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 322369a5b748 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | b56da41cf178 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | bb2939094eed | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 74d6d33376eb | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 3d0f1ddeebf5 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 67f99a5beab7 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 533ce58c6e02 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 9b4415e937b2 | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 45459c0910fc | python-multipart | 0.0.30 | 1 |
| ghcr.io/ | 6e04659a3baa | python-multipart | 0.0.30 | 1 |
| quay.io/ | 2c324c9789f5 | python-multipart | 0.0.30 | 1 |
| quay.io/ | 3194d46df0f9 | python-multipart | 0.0.30 | 1 |
| quay.io/ | cba71dc08c8a | python-multipart | 0.0.30 | 1 |