Allocation of Resources Without Limits or Throttling in starlette - CVE-2026-54283
Published: November 6, 2026
Vulnerability identifier: #VU159848
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54283
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service in Starlette applications that parse URL-encoded form requests.
The vulnerability exists due to Starlette's URL-encoded parser ignoring max_fields and max_part_size limits when applications call request.form() on application/x-www-form-urlencoded requests. An unauthenticated remote attacker can submit excessive fields or an oversized field to block the worker's event loop or force unbounded memory allocation, making the service unavailable through parallel requests.
Affected software
starlette
Debian Linux
starlette (Debian package)
Debian Linux
starlette (Debian package)
How to mitigate CVE-2026-54283
Install security update from vendor's website.
starlette - update to 1.3.1
starlette (Debian package) - update to 0.46.1-3+deb13u3
starlette (Debian package) - update to 0.46.1-3+deb13u3