CVE-2026-54283

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*

History

26 Jun 2026, 19:16

Type	Values Removed	Values Added
References	~~() https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq -~~	() https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq - Mitigation, Vendor Advisory
CPE		cpe:2.3:a:encode:starlette::::::python::*
First Time		Encode starlette Encode

22 Jun 2026, 18:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-22 18:16

Updated : 2026-06-26 19:16

NVD link : CVE-2026-54283

Mitre link : CVE-2026-54283

CVE.ORG link : CVE-2026-54283

JSON object : View

Products Affected

encode

starlette

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-54283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T16:06:30.546768Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Kludex", "product": "starlette", "versions": [{"status": "affected", "version": ">= 0.4.1, < 1.3.1"}]}]}], "published": "2026-06-22T18:16:46.943", "references": [{"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1."}], "lastModified": "2026-06-26T19:16:55.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "2FDB02B2-DCF6-4F2C-B06B-78C015D16494", "versionEndExcluding": "1.3.1", "versionStartIncluding": "0.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}