CVE-2026-54283

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Starlette es un framework/toolkit ASGI ligero. Desde la versión 0.4.1 hasta la 1.3.1, request.form() acepta max_fields y max_part_size para limitar el consumo de recursos al analizar datos de formulario. Estos límites se aplican para multipart/form-data, pero se ignoran silenciosamente para application/x-www-form-urlencoded. Un atacante no autenticado puede, por lo tanto, enviar un cuerpo urlencoded con un número arbitrariamente grande de campos o un campo arbitrariamente grande, incluso cuando la aplicación configuró límites que creía que se aplicarían. Esta vulnerabilidad se corrige en la versión 1.3.1.

Information

Published : 2026-06-22 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-54283

Mitre link : CVE-2026-54283

CVE.ORG link : CVE-2026-54283

JSON object : View

Products Affected

encode

starlette

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-54283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T16:06:30.546768Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Kludex", "product": "starlette", "versions": [{"status": "affected", "version": ">= 0.4.1, < 1.3.1"}]}]}], "published": "2026-06-22T18:16:46.943", "references": [{"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1."}, {"lang": "es", "value": "Starlette es un framework/toolkit ASGI ligero. Desde la versi\u00f3n 0.4.1 hasta la 1.3.1, request.form() acepta max_fields y max_part_size para limitar el consumo de recursos al analizar datos de formulario. Estos l\u00edmites se aplican para multipart/form-data, pero se ignoran silenciosamente para application/x-www-form-urlencoded. Un atacante no autenticado puede, por lo tanto, enviar un cuerpo urlencoded con un n\u00famero arbitrariamente grande de campos o un campo arbitrariamente grande, incluso cuando la aplicaci\u00f3n configur\u00f3 l\u00edmites que cre\u00eda que se aplicar\u00edan. Esta vulnerabilidad se corrige en la versi\u00f3n 1.3.1."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "2FDB02B2-DCF6-4F2C-B06B-78C015D16494", "versionEndExcluding": "1.3.1", "versionStartIncluding": "0.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}