CVE-2026-54283

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

• CWE-770

• https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfqMitigation, Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54278AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-54279AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-5428The Royal Elementor Addons plugin for WordPress is vulnerabl…6.4
• CVE-2026-54280AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-54281Nest is a framework for building scalable Node.js server-sid…8.7
• CVE-2026-54282Starlette is a lightweight ASGI framework/toolkit. Prior to …5.3
• CVE-2026-54285opentelemetry-js is the OpenTelemetry JavaScript Client. Pri…5.3
• CVE-2026-54286Hono is a Web application framework that provides support fo…5.9
• CVE-2026-54287Hono is a Web application framework that provides support fo…5.3
• CVE-2026-54288Hono is a Web application framework that provides support fo…6.5
• CVE-2026-54289Hono is a Web application framework that provides support fo…4.8
• CVE-2026-5429Unsanitized input during web page generation in the Kiro Age…7.8