{"id":"CVE-2026-54283","aliases":["CLSA-2026-1782954022","CLSA-2026-1789447406","CLSA-2026-1789537996","DEBIAN-CVE-2026-54283","EUVD-2026-38319","GHSA-82w8-qh3p-5jfq","MGASA-2026-0413","PYSEC-2026-249","ROOT-APP-PYPI-CVE-2026-54283","SUSE-SU-2026:22360-1","UBUNTU-CVE-2026-54283","openSUSE-SU-2026:21053-1"],"status":"published","title":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00481,"percentile":0.41789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-06-15T20:39:53Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"PyPI","package":"starlette","fixed_in":["1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"starlette","fixed_in":["0.27.0.post5+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"starlette","fixed_in":["0.26.1-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"starlette","fixed_in":["0.46.1-3+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"starlette","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"starlette","fixed_in":["0.27.0+aikido.11","0.22.0+aikido.7","1.0.0+aikido.1","0.41.3+aikido.5","0.41.3+aikido.6","0.49.3+aikido.3","0.46.2+aikido.6","1.0.1+aikido.1","0.45.3+aikido.13","0.52.1+aikido.2","1.2.1+aikido.1","1.2.0+aikido.1","0.49.1+aikido.2","1.1.0+aikido.1","0.50.0+aikido.1","0.49.2+aikido.3","1.3.0+aikido.1","0.50.0+aikido.2","0.45.3+aikido.14","0.49.3+aikido.4","0.49.2+aikido.4","0.41.3+aikido.7","0.46.2+aikido.7","0.52.1+aikido.3","1.0.0+aikido.2","1.0.1+aikido.2","0.49.1+aikido.3","1.0.0+aikido.3","0.45.3+aikido.15","0.50.0+aikido.3","0.22.0+aikido.6","0.27.0+aikido.10"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.1"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.0"},{"fixed":"0.27.0.post5+tuxcare"}]}],"versions":["0.27.0","0.27.0.post1+tuxcare","0.27.0.post2+tuxcare","0.27.0.post3+tuxcare","0.27.0.post4+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"fixed":"0.25.0.post1+tuxcare"}]}],"versions":["0.25.0"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.6"},{"fixed":"0.13.6.post5+tuxcare"}]}],"versions":["0.13.6","0.13.6.post1+tuxcare","0.13.6.post2+tuxcare","0.13.6.post3+tuxcare","0.13.6.post4+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-1+deb12u2"}]}],"versions":["0.26.1-1","0.26.1-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.1-3+deb13u3"}]}],"versions":["0.46.1-3","0.46.1-3+deb13u1","0.46.1-3+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}],"versions":["0.46.1-3","0.50.0-1","1.0.0-1","1.1.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.1"},{"fixed":"1.3.1"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.0-3.2.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.1"},{"fixed":"1.3.1"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0"]},{"source":"osv","ecosystem":"Root:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0+aikido.11"},{"fixed":"0.22.0+aikido.7"},{"fixed":"1.0.0+aikido.1"},{"fixed":"0.41.3+aikido.5"},{"fixed":"0.41.3+aikido.6"},{"fixed":"0.49.3+aikido.3"},{"fixed":"0.46.2+aikido.6"},{"fixed":"1.0.1+aikido.1"},{"fixed":"0.45.3+aikido.13"},{"fixed":"0.52.1+aikido.2"},{"fixed":"1.2.1+aikido.1"},{"fixed":"1.2.0+aikido.1"},{"fixed":"0.49.1+aikido.2"},{"fixed":"1.1.0+aikido.1"},{"fixed":"0.50.0+aikido.1"},{"fixed":"0.49.2+aikido.3"},{"fixed":"1.3.0+aikido.1"},{"fixed":"0.50.0+aikido.2"},{"fixed":"0.45.3+aikido.14"},{"fixed":"0.49.3+aikido.4"},{"fixed":"0.49.2+aikido.4"},{"fixed":"0.41.3+aikido.7"},{"fixed":"0.46.2+aikido.7"},{"fixed":"0.52.1+aikido.3"},{"fixed":"1.0.0+aikido.2"},{"fixed":"1.0.1+aikido.2"},{"fixed":"0.49.1+aikido.3"},{"fixed":"1.0.0+aikido.3"},{"fixed":"0.45.3+aikido.15"},{"fixed":"0.50.0+aikido.3"},{"fixed":"0.22.0+aikido.6"},{"fixed":"0.27.0+aikido.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.1-1","0.16.0-1","0.18.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.0-1","0.31.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.46.1-2","0.46.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.0-1","1.1.0-1","1.3.1-1","1.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.46.1-3","0.50.0-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.4.1"}]}],"bundled":3}],"products":[{"vendor":"encode","product":"starlette"},{"vendor":"kludex","product":"starlette"}],"references":[{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/advisories/GHSA-82w8-qh3p-5jfq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54283.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54283","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54283","tags":["advisory"]},{"url":"https://github.com/Kludex/starlette","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0413.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36224","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00389.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622360-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268389","tags":["report"]},{"url":"https://bugzilla.suse.com/1268517","tags":["report"]},{"url":"https://bugzilla.suse.com/1268520","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54283","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-54283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54283","tags":["report"]},{"url":"https://github.com/Kludex/starlette/pull/3329","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-54283","title":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","status":"published","published":"2026-06-22T16:46:16.706Z","modified":"2026-06-23T16:10:51.227Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-38319","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","status":"published","published":"2026-06-22T16:46:16Z","modified":"2026-06-23T16:10:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"ghsa":[{"id":"GHSA-82w8-qh3p-5jfq","title":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","description":"### Summary\n`request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\n### Details\n`request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded` the parser is constructed without them. It has no `max_fields` or `max_part_size` parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.\n\nBecause the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:\n\n- **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as `f0=v\u0026f1=v\u0026...`) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.\n- **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the `FormData`, forcing memory allocation proportional to the request body.\n\nThe equivalent `multipart/form-data` request is correctly rejected with `400 Too many fields` / `400 Field exceeded maximum size`.\n\n### Impact\nThis Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call `request.form()` on `application/x-www-form-urlencoded` requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.\n\n### Mitigation\nUpgrade to a patched version, which forwards `max_fields` and `max_part_size` to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match `multipart/form-data` (`max_fields=1000`, `max_part_size=1MB`) and can be customized via `request.form(max_fields=..., max_part_size=...)`.","status":"published","published":"2026-06-15T20:39:53Z","modified":"2026-06-15T20:39:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-54283","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","status":"published","published":"2026-06-22T18:16:46.943Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-54283","title":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","status":"published","published":"2026-06-22T16:46:16.706Z","modified":"2026-10-28T02:31:13.705760945Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54283","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","status":"published","published":"2026-06-22T18:16:46.943Z","modified":"2026-10-26T11:47:32.892666092Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-82w8-qh3p-5jfq","title":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","description":"### Summary\n`request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\n### Details\n`request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded` the parser is constructed without them. It has no `max_fields` or `max_part_size` parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.\n\nBecause the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:\n\n- **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as `f0=v\u0026f1=v\u0026...`) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.\n- **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the `FormData`, forcing memory allocation proportional to the request body.\n\nThe equivalent `multipart/form-data` request is correctly rejected with `400 Too many fields` / `400 Field exceeded maximum size`.\n\n### Impact\nThis Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call `request.form()` on `application/x-www-form-urlencoded` requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.\n\n### Mitigation\nUpgrade to a patched version, which forwards `max_fields` and `max_part_size` to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match `multipart/form-data` (`max_fields=1000`, `max_part_size=1MB`) and can be customized via `request.form(max_fields=..., max_part_size=...)`.","status":"published","published":"2026-06-15T20:39:53Z","modified":"2026-09-10T03:51:08.15619903Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"PYSEC-2026-249","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","status":"published","published":"2026-06-22T18:16:46.943Z","modified":"2026-06-27T11:15:06.800792374Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"UBUNTU-CVE-2026-54283","description":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","status":"published","published":"2026-06-22T18:16:00Z","modified":"2026-10-17T12:58:35.447706943Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1782954022","title":"TuxCare security update for starlette (1 CVE)","description":"TuxCare rebuilt starlette to address 1 CVE. Fixed in 0.27.0.post5+tuxcare.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T09:48:05.424739121Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1789447406","title":"TuxCare security update for starlette (8 CVEs)","description":"TuxCare rebuilt starlette to address 8 CVEs. Fixed in 0.25.0.post1+tuxcare.","status":"published","published":"2026-09-15T04:43:26Z","modified":"2026-10-15T09:48:01.789333066Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789537996","title":"TuxCare security update for starlette (4 CVEs)","description":"TuxCare rebuilt starlette to address 4 CVEs. Fixed in 0.13.6.post5+tuxcare.","status":"published","published":"2026-09-16T05:53:16Z","modified":"2026-10-15T09:48:01.802525719Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0413","title":"Updated python-starlette package fixes security vulnerabilities","description":"Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via\n`getattr`. (CVE-2026-48817)\nUnvalidated request path concatenated into authority poisons\nrequest.url.hostname. (CVE-2026-54282)\n","status":"published","published":"2026-09-17T14:10:41Z","modified":"2026-09-17T14:15:02.602502957Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21053-1","title":"Security update for python-starlette","description":"This update for python-starlette fixes the following issues\n\n- CVE-2026-48817: arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` (bsc#1268389).\n- CVE-2026-54282: request path that lacks a leading forward slash can lead to request.url.hostname manipulation\n  (bsc#1268520).\n- CVE-2026-54283: urlencoded request body with an oversized data can lead to a denial of service (bsc#1268517).\n","status":"published","published":"2026-06-24T21:39:55Z","modified":"2026-06-30T18:24:37.951801192Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-PYPI-CVE-2026-54283","title":"CVE-2026-54283 in starlette - Patched by Root","description":"Root has patched CVE-2026-54283 in the starlette package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-09-14T10:42:48Z","modified":"2026-09-14T11:15:04.321702097Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2026:22360-1","title":"Security update for python-starlette","description":"This update for python-starlette fixes the following issues\n\n- CVE-2026-48817: arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` (bsc#1268389).\n- CVE-2026-54282: request path that lacks a leading forward slash can lead to request.url.hostname manipulation\n  (bsc#1268520).\n- CVE-2026-54283: urlencoded request body with an oversized data can lead to a denial of service (bsc#1268517).\n","status":"published","published":"2026-06-24T21:41:06Z","modified":"2026-07-02T18:24:12.84134627Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}