CVE-2026-54283
published 2026-06-22CVE-2026-54283: Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.27%
19.2th percentile
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| encode | starlette | >= 0.4.1 < 1.3.1 | 1.3.1 |
| encode | starlette | >= 0.4.1 < 1.3.1 | 1.3.1 |
| kludex | starlette | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Kludex starlette up to 1.3.0 request.form allocation of resources (GHSA-82w8-qh3p-5jfq)
vuldb·2026-06-22·CVSS 7.5
CVE-2026-54283 [HIGH] Kludex starlette up to 1.3.0 request.form allocation of resources (GHSA-82w8-qh3p-5jfq)
A vulnerability labeled as problematic has been found in Kludex starlette up to 1.3.0. This vulnerability affects the function request.form. Executing a manipulation can lead to allocation of resources.
This vulnerability is registered as CVE-2026-54283. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
GHSA
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
ghsa·2026-06-15
CVE-2026-54283 [HIGH] CWE-770 Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
### Summary
`request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.
### Details
`request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded`
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published