CVE-2026-54283

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Description

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

Scores

Weaknesses (CWE)

• CWE-770

Advisories

• GHSA-82w8-qh3p-5jfq — Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
• PYSEC-2026-249 — Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption whi

European references

• ENISA EUVD · EUVD-2026-38319
• GCVE · GCVE-0-2026-54283

CERT-FR advisories

• CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
• CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* ≥ 0.4.1 < 1.3.1

Affected products

References

• https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq

Sources