Resource Consumption Issue in Starlette ASGI Framework by Kludex

CVE-2026-54283

What is CVE-2026-54283?

Starlette, a lightweight ASGI framework developed by Kludex, has an issue that impacts the handling of form data. Specifically, the request.form() method is designed to enforce limits on resource consumption when parsing multipart/form-data based on max_fields and max_part_size settings. However, these limits are not applied to application/x-www-form-urlencoded content types. As a result, an unauthenticated attacker could exploit this oversight by sending a URL-encoded body that contains either an excessive number of fields or a single excessively large field. This poses a serious risk, particularly for applications that rely on these configurations to manage resource allocation effectively. The issue has been addressed and resolved in version 1.3.1 of Starlette.

References