Executive brief
Starlette is a popular software library used to build web applications and APIs, including those built with the FastAPI framework. A flaw in how it handles web forms allows an attacker to send specially crafted requests that bypass security limits on data size and field counts. This can lead to a denial-of-service (DoS) condition, where the application becomes unresponsive or crashes due to excessive memory and processor usage, potentially disrupting business operations.
Technical details
A resource exhaustion vulnerability exists in Starlette's request.form() method. While the framework correctly enforces 'max_fields' and 'max_part_size' for 'multipart/form-data' requests, it silently ignores these limits when processing 'application/x-www-form-urlencoded' payloads. An unauthenticated remote attacker can exploit this by sending a request with an extremely large number of fields to block the asynchronous event loop, or a single massive field to force unbounded memory allocation. This can result in a complete denial-of-service (DoS) for the affected worker. The issue is resolved in version 1.3.1 by ensuring the URL-encoded parser respects the configured resource bounds.
Affected products
- Kludex starlette >= 0.4.1, < 1.3.1
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published by maintainer
- 2026-06-22: disclosed: CVE-2026-54283 published to NVD
- 2026-06-12: patched: Fixed in version 1.3.1