---
schema_version: '1.0'
id: security-20260711-d980d5
url: https://osv.dev/vulnerability/PYSEC-2026-249
url_hash: d980d5762471dde9ffc79d9208c65e6cb076fd88a6b128fa9dc5354b43a7bafb
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-249
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54283
- PYSEC-2026-249
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- starlette
- PyPI
lang: en
published_at: '2026-06-22T18:16:46Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:40:39Z'
status: published
content_hash: 0e92a560cfe4db98145a9651b5531fa4f2a9e4032d544c87b1b38a10bbce0a7a
license_note: full
summary: Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1,
  request.form() accepts max_fields and max_part_size to bound resource consumption
  while parsing form data. These limits are enforced for multipart/form-data, but
  silently ignored for application/x-www-form
summary_source: rss
summary_en: Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1,
  request.form() accepts max_fields and max_part_size to bound resource consumption
  while parsing form data. These limits are enforced for multipart/form-data, but
  silently ignored for application/x-www-form
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-54283 — starlette
---

# CVE-2026-54283 — starlette

## TL;DR
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form

## Key Points
- cve / CVE-2026-54283 / PYSEC-2026-249 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / starlette / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-249 (CVE-2026-54283)

**Affected (your watchlist):**
- `PyPI:starlette` 0.41.3 → fixed in 1.3.1 [docker/docker-portal]
- `PyPI:starlette` 1.0.0 → fixed in 1.3.1 [docker/local]
- `PyPI:starlette` 1.1.0 → fixed in 1.3.1 [docker/mac]
- `PyPI:starlette` 1.3.0 → fixed in 1.3.1 [docker/local]

**Details:**
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

**References:**
- https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-249_

## Source
元記事: [CVE-2026-54283 — starlette](https://osv.dev/vulnerability/PYSEC-2026-249) — published 2026-06-22T18:16:46Z