CVE-2026-54283
HIGH EPSS 19.2%
Published Jun 22, 20261w ago · Modified Jun 23, 20261w ago
7.5 CVSS 3.1
Published Jun 22, 2026 1w ago
Last Modified Jun 23, 2026 1w ago
Description
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
19.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-770
References 1
- github.com https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.