PT-2026-49597 · Pypi · Starlette

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-54283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Starlette (affected versions not specified) FastAPI (affected versions not specified)

Description A Denial of Service (DoS) issue exists in the request.form() function when processing application/x-www-form-urlencoded requests. While limits for max fields and max part size are enforced for multipart/form-data, they are ignored for url-encoded bodies. This allows an unauthenticated attacker to cause resource exhaustion through two methods: sending a large number of fields (e.g., 1,000,000 fields), which blocks the worker's event loop and consumes CPU, or sending a single very large field, which forces unbounded memory allocation.

Recommendations Upgrade to a patched version of Starlette and FastAPI to ensure max fields and max part size are enforced for url-encoded parsers. As a temporary workaround, restrict the request body size via a reverse proxy to reduce the risk of memory exhaustion, although this may not fully prevent event-loop blocking.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-54283

GHSA-82W8-QH3P-5JFQ

Affected Products

Starlette

References · 4

• https://osv.dev/vulnerability/GHSA-82w8-qh3p-5jfq · Vendor Advisory
• https://github.com/Kludex/starlette · Note
• https://twitter.com/dailycve/status/2066670215002272001 · Twitter Post
• https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq · Note