CVE-2026-54283
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 22, 2026
CISA due date
—
The record
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-starlette | 0 | 0.41.3-160000.4.1 |
Related vulnerabilities
- CVE-2026-54282 Starlette is a lightweight ASGI framework/toolkit. Also affects python-starlette
- CVE-2026-48817 Starlette is a lightweight ASGI framework/toolkit. Also affects python-starlette
- CVE-2026-48710 Starlette is a lightweight ASGI framework/toolkit. Also affects python-starlette
- CVE-2025-62727 Starlette is a lightweight ASGI framework/toolkit. Also affects python-starlette
- CVE-2025-54121 Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface)… Also affects python-starlette
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770
- CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined… CWE-770
- CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform… CWE-770