7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54283

CVE-2026-54283: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54283

CVE-2026-54283:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
starlette	pip	>= 0.4.1, < 1.3.1	1.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Starlette's handling of application/x-www-form-urlencoded form data. The request.form() method, a common entry point for handling form submissions, did not enforce configured limits (max_fields and max_part_size) for this specific content type. This was because the underlying FormParser was not initialized with these limits, and its parse method lacked the necessary checks.

An unauthenticated attacker could send a POST request with a massive number of fields or an extremely large field value. This would cause the FormParser.parse function to either enter a long loop, consuming CPU and blocking the server's event loop, or allocate a large amount of memory, leading to a denial-of-service (DoS) condition.

The patch rectifies this by updating the Request._get_form method to pass the limits to the FormParser constructor. The FormParser itself was modified to accept these limits and enforce them during the parsing process, throwing an exception if the limits are exceeded. The primary vulnerable functions are Request.form (the public API) and FormParser.parse (where the resource exhaustion occurs).

Vulnerable functions

Request.form

starlette/requests.py

This is the main entry point for parsing form data. Before the patch, it would call the underlying parser for `application/x-www-form-urlencoded` data without enforcing any limits on the number of fields or their size, making it vulnerable to DoS attacks.

FormParser.parse

starlette/formparsers.py

This function is responsible for parsing `application/x-www-form-urlencoded` data. The vulnerability lies in this function's original implementation, which processed an unlimited number of fields and field sizes, leading to excessive resource consumption (CPU and memory). The patch adds checks to enforce `max_fields` and `max_part_size` limits within this function.

FormParser.__init__

starlette/formparsers.py

The constructor for `FormParser` was modified to accept `max_fields` and `max_part_size` limits. The original version did not accept these parameters, which is why the limits were not enforced for `application/x-www-form-urlencoded` data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.