VYPR
← All advisories
High severity7.5GHSA Advisory· Published Jun 22, 2026· Updated Jun 26, 2026

CVE-2026-54283

CVE-2026-54283

Description

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
starlettePyPI
>= 0.4.1, < 1.3.11.3.1

Affected products

26

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.