CVE-2026-54283: Starlette denial of service via resource limit bypass in request.form

CVE-2026-54283 · Severity: high · CVSS 7.5 · Published 2026-06-22

Starlette is a popular software library used to build web applications and APIs, including those built with the FastAPI framework. A flaw in how it handles web forms allows an attacker to send specially crafted requests that bypass security limits on data size and field counts. This can lead to a denial-of-service (DoS) condition, where the application becomes unresponsive or crashes due to excessive memory and processor usage, potentially disrupting business operations.

Technologies: Kludex Starlette-Auth-Toolkit, starlette (PyPI). Vendors: Kludex, PyPI.

Quick answers

Is CVE-2026-54283 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54283 being exploited in the wild.
How severe is CVE-2026-54283?
High severity, with a CVSS score of 7.5, published 22 June 2026.
Which products and versions are affected?
Kludex Starlette-Auth-Toolkit >= 0.4.1, < 1.3.1; starlette (PyPI) ECOSYSTEM:introduced=0.4.1,fixed=1.3.1.
Is there a fix for CVE-2026-54283?
Yes. starlette (PyPI): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54283 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54283?
Check whether you run Kludex Starlette-Auth-Toolkit or starlette (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • starlette (PyPI): upgrade to 1.3.1 or later
    pip install "starlette>=1.3.1"

Technical details

A resource exhaustion vulnerability exists in Starlette's request.form() method. While the framework correctly enforces 'max_fields' and 'max_part_size' for 'multipart/form-data' requests, it silently ignores these limits when processing 'application/x-www-form-urlencoded' payloads. An unauthenticated remote attacker can exploit this by sending a request with an extremely large number of fields to block the asynchronous event loop, or a single massive field to force unbounded memory allocation. This can result in a complete denial-of-service (DoS) for the affected worker. The issue is resolved in version 1.3.1 by ensuring the URL-encoded parser respects the configured resource bounds.

Affected products

  • Kludex starlette >= 0.4.1, < 1.3.1

Identifiers

  • CVE-2026-54283
  • GHSA-82w8-qh3p-5jfq
  • PYSEC-2026-249

Timeline

  • 2026-06-12: advisory: GitHub Security Advisory published by maintainer
  • 2026-06-22: disclosed: CVE-2026-54283 published to NVD
  • 2026-06-12: patched: Fixed in version 1.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.