2026-06-17 - python-multipart 0.0.31 fresh 4-CVE cluster: WALK CLEAN (sibling-quadratic hypothesis empirically disproved)

Date: 2026-06-17 Target: python-multipart 0.0.31 (fresh cluster, disclosed ~2026-06-16) Verdict: WALK CLEAN.

The cluster (4 fresh CVEs, one version line)

• GHSA-5rvq-cxj2-64vf [HIGH] quadratic-time querystring parsing via ; -> CPU DoS (fix@0.0.30)
• GHSA-6jv3-5f52-599m [low] ; treated as querystring field separator -> param smuggling (fix@0.0.30)
• GHSA-vffw-93wf-4j4q [low] Content-Disposition RFC 2231/5987 extended-param smuggling (fix@0.0.30)
• GHSA-v9pg-7xvm-68hf [low] negative Content-Length buffers whole body (fix@0.0.31)

Completeness check (all fixed)

• 1+#3: QuerystringParser is now a byte-by-byte O(n) state machine and ; is NO LONGER a separator.

  Verified: a=1;b=2&c=3 -> [(a, '1;b=2'),(c,'3')]. Both the quadratic and the smuggling die from the same change.

• 4: parse_options_header does if "*" in key: continue - a BROAD check catching every RFC 2231/5987 form

  (filename*=, filename*0*=, continuations). Keeps the plain key authoritative. No smuggle.

• 2: int(content_length); if content_length < 0: raise ValueError. (non-numeric -> ValueError, acceptable 400.)

Sibling hypothesis tested and DISPROVED (the value of this cycle)

The querystring fix wouldn't touch _parseparam (the SEPARATE header-options ;-splitter, vendored from stdlib email._parseparam) which has an inner quote-counting loop s.count('"', ind, end) over a growing string -> I hypothesized an O(n^2) sibling on an unclosed-quote + many-semicolons Content-Type/Disposition header (attacker-controlled in uploads). EMPIRICAL timing: LINEAR (2k->16k semicolons = 2.5ms->19.7ms, ratio ~2x per 2x; N quoted params likewise exactly 2x). The windowed counts stay small per iteration -> no quadratic. Walk.

Lesson: when chasing a "quadratic in parser A" CVE, the natural set-difference is "parser B in the same lib

that ALSO splits on the same delimiter." Here that sibling (_parseparam) existed and was a plausible O(n^2) by inspection - but EMPIRICAL doubling-test disproved it (windowed counts != growing-range counts). Don't claim a complexity bug from code-shape alone; the constant-vs-quadratic distinction needs the timing test (mirrors the Django Truncator cycle where the timing CONFIRMED, here it REFUTED). Same method, opposite outcome = honest.

Predictor: python-multipart is small BUT a FastAPI/Starlette dep (moderate scrutiny) and the cluster was a

coordinated thorough disclosure -> swept. Fresh != automatically low-scrutiny. Cluster #1 of today's fresh hunt.