CVE-2026-54283 Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
An unauthenticated attacker can cause denial of service by sending large urlencoded form data, bypassing configured resource limits in Starlette.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54283?
CVE-2026-54283 is a high-severity denial of service vulnerability in Kludex starlette, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.
Weakness: CWE-770
Which versions are affected by CVE-2026-54283?
3 open source packages ship an affected version, including starlette. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
starlette PyPI | From 0.4.1 | 1.3.1 |
starlette PyPI | From 0.4.1 | 1.3.1 |
starlette PyPI | From 0.4.1 | 1.3.1 |
Products include Encode Starlette.
How do I fix CVE-2026-54283?
Upgrade starlette to 1.3.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54283 being exploited?
There is no known exploitation of CVE-2026-54283 in the wild and no public exploit code.
Other vulnerabilities in Kludex starlette
- CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling
- CVE-2026-48818 Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
- CVE-2023-29159 Starlette has Path Traversal vulnerability in StaticFiles
- CVE-2023-30798 MultipartParser DOS with too many fields or files in Starlette Framework
- CVE-2026-48817 Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Sources
Also known as CLEANSTART-2026-PN29190, CLEANSTART-2026-SB78573, CLSA-2026-1782954022, DEBIAN-CVE-2026-54283, ECHO-9688-fa29-3d55, GHSA-82w8-qh3p-5jfq and 20 more.