# CVE-2026-54283: Starlette denial of service via resource limit bypass in request.form

Source: https://junglewise.ai/threats/cve-2026-54283-starlette-denial-of-service-via-resource-limit-bypass-in-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-54283 · Severity: high · CVSS 7.5 · Published 2026-06-22

Starlette is a popular software library used to build web applications and APIs, including those built with the FastAPI framework. A flaw in how it handles web forms allows an attacker to send specially crafted requests that bypass security limits on data size and field counts. This can lead to a denial-of-service (DoS) condition, where the application becomes unresponsive or crashes due to excessive memory and processor usage, potentially disrupting business operations.

Technologies: [Kludex Starlette-Auth-Toolkit](https://junglewise.ai/threats/technologies/starlette-auth-toolkit), [starlette (PyPI)](https://junglewise.ai/threats/technologies/pypi-starlette). Vendors: [Kludex](https://junglewise.ai/threats/vendors/kludex), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54283 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54283 being exploited in the wild.

**How severe is CVE-2026-54283?** High severity, with a CVSS score of 7.5, published 22 June 2026.

**Which products and versions are affected?** Kludex Starlette-Auth-Toolkit >= 0.4.1, < 1.3.1; starlette (PyPI) ECOSYSTEM:introduced=0.4.1,fixed=1.3.1.

**Is there a fix for CVE-2026-54283?** Yes. starlette (PyPI): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54283 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54283?** Check whether you run Kludex Starlette-Auth-Toolkit or starlette (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- starlette (PyPI): upgrade to 1.3.1 or later

  ```sh
  pip install "starlette>=1.3.1"
  ```


## Technical details

A resource exhaustion vulnerability exists in Starlette's request.form() method. While the framework correctly enforces 'max_fields' and 'max_part_size' for 'multipart/form-data' requests, it silently ignores these limits when processing 'application/x-www-form-urlencoded' payloads. An unauthenticated remote attacker can exploit this by sending a request with an extremely large number of fields to block the asynchronous event loop, or a single massive field to force unbounded memory allocation. This can result in a complete denial-of-service (DoS) for the affected worker. The issue is resolved in version 1.3.1 by ensuring the URL-encoded parser respects the configured resource bounds.

## Affected products

- Kludex starlette >= 0.4.1, < 1.3.1

## Identifiers

- CVE-2026-54283
- GHSA-82w8-qh3p-5jfq
- PYSEC-2026-249

## Timeline

- 2026-06-12: advisory: GitHub Security Advisory published by maintainer
- 2026-06-22: disclosed: CVE-2026-54283 published to NVD
- 2026-06-12: patched: Fixed in version 1.3.1

## References

- [https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq](https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq)

## Related threats

- [PYSEC-2026-1941 - Starlette has possible denial-of-service vector when parsing large files in multipart forms](https://junglewise.ai/threats/cve-2025-54121-starlette-denial-of-service-in-multipart-form-parsing)
- [PYSEC-2026-1943 - Starlette Denial of service (DoS) via multipart/form-data](https://junglewise.ai/threats/cve-2024-47874-starlette-denial-of-service-dos-via-multipart-form-data)
- [Kludex Starlette hostname spoofing via unvalidated request path](https://junglewise.ai/threats/cve-2026-54282-kludex-starlette-hostname-spoofing-via-unvalidated-request-path)
- [Starlette unsafe reflection in HTTPEndpoint method dispatching](https://junglewise.ai/threats/cve-2026-48817-starlette-unsafe-reflection-in-httpendpoint-method-dispatching)
- [Kludex Starlette SSRF and NTLM credential theft in StaticFiles on Windows](https://junglewise.ai/threats/cve-2026-48818-kludex-starlette-ssrf-and-ntlm-credential-theft-in-staticfiles-on)