SB20261106112 - Multiple vulnerabilities in starlette

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261106112

SB20261106112 - Multiple vulnerabilities in starlette

Published: November 6, 2026

Security Bulletin ID SB20261106112
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-54283)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause denial of service in Starlette applications that parse URL-encoded form requests.

The vulnerability exists due to Starlette's URL-encoded parser ignoring max_fields and max_part_size limits when applications call request.form() on application/x-www-form-urlencoded requests. An unauthenticated remote attacker can submit excessive fields or an oversized field to block the worker's event loop or force unbounded memory allocation, making the service unavailable through parallel requests.


Remediation

Install update from vendor's website.

References