# What changed in python-multipart

> 12 changes in python-multipart 0.0 from its official release notes, upgrade guides and advisories: 2 breaking, 9 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/pypi/python-multipart/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## python-multipart 0.0

### Breaking changes

- Ignores RFC 2231 extended parameters when parsing options headers. (0.0.30) — [release notes](https://github.com/Kludex/python-multipart/releases/tag/0.0.30)
- Only `&` is treated as the urlencoded field separator. (0.0.30) — [release notes](https://github.com/Kludex/python-multipart/releases/tag/0.0.30)

### Security

- Header field name size is bounded before validation. (0.0.31) — [release notes](https://github.com/Kludex/python-multipart/releases/tag/0.0.31)
- parse_form validates that Content-Length is non-negative. (0.0.31) — [release notes](https://github.com/Kludex/python-multipart/releases/tag/0.0.31)
- python-multipart: Negative Content-Length in parse_form buffers the entire body in memory (0.0.31) — [security advisory](https://github.com/advisories/GHSA-V9PG-7XVM-68HF)
- python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters (0.0.30) — [security advisory](https://github.com/advisories/GHSA-VFFW-93WF-4J4Q)
- python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service (0.0.30) — [security advisory](https://github.com/advisories/GHSA-5RVQ-CXJ2-64VF)
- python-multipart: Semicolon treated as querystring field separator enables parameter smuggling (0.0.30) — [security advisory](https://github.com/advisories/GHSA-6JV3-5F52-599M)
- python-multipart has Denial of Service via unbounded multipart part headers (0.0.27) — [security advisory](https://github.com/advisories/GHSA-PP6C-GR5W-3C5G)
- python-multipart affected by Denial of Service via large multipart preamble or epilogue data (0.0.26) — [security advisory](https://github.com/advisories/GHSA-MJ87-HWQH-73PJ)
- Python-Multipart has Arbitrary File Write via Non-Default Configuration (0.0.22) — [security advisory](https://github.com/advisories/GHSA-WP53-J4WJ-2CFG)

### Performance

- Multipart header parsing and callback dispatch are faster. (0.0.31) — [release notes](https://github.com/Kludex/python-multipart/releases/tag/0.0.31)