PT-2026-49597 · Fastapi+1 · Fastapi+1
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Starlette (affected versions not specified)
FastAPI (affected versions not specified)
Description
A Denial of Service (DoS) issue exists in the
request.form() function when processing application/x-www-form-urlencoded requests. While limits for max fields and max part size are enforced for multipart/form-data, they are ignored for url-encoded bodies. This allows an unauthenticated attacker to cause resource exhaustion through two methods: sending a large number of fields (e.g., 1,000,000 fields), which blocks the worker's event loop and consumes CPU, or sending a single very large field, which forces unbounded memory allocation.Recommendations
Upgrade to a patched version of Starlette and FastAPI to ensure
max fields and max part size are enforced for url-encoded parsers.
As a temporary workaround, restrict the request body size via a reverse proxy to reduce the risk of memory exhaustion, although this may not fully prevent event-loop blocking.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fastapi
Starlette