{"id":"CVE-2026-54283","published":"2026-06-22T16:46:16Z","modified":"2026-06-23T16:10:51Z","title":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","vendor":"Kludex","product":"starlette","tier":"tail","description":{"text":"Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00481,"percentile":0.41334,"provenance":"source"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.5,"factors":[{"name":"EPSS percentile","points":8.27},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"kludex","affectedVersions":[{"vendor":"Kludex","product":"starlette","versions":[">= 0.4.1, < 1.3.1"]}],"affected":[{"ecosystem":"PyPI","package":"starlette","vulnerableRanges":[">=0.4.1, <1.3.1"],"patched":["1.3.1"],"from":["GHSA-82w8-qh3p-5jfq","PYSEC-2026-249"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-38319","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-48710","published":"2026-05-26","fixed":"1.0.1","kev":true},{"cve":"CVE-2026-48817","published":"2026-06-17","fixed":"1.1.0","kev":false},{"cve":"CVE-2026-48818","published":"2026-06-17","fixed":"1.1.0","kev":false,"link":{"from":"CVE-2026-48818","to":"CVE-2026-54283","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:starlette","fromFixed":"1.1.0","toFixed":"1.3.1","daysApart":5}]}},{"cve":"CVE-2026-54283","published":"2026-06-22","fixed":"1.3.1","kev":false}],"package":"PyPI:starlette"}}