Vulnerabilities

Vulnerability · CVE-2026-54283

request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Published Jun 12, 2026 · catalog updated Jun 12, 2026 · request.form() limits silently ignored

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-54283. EPSS is 0.48%. Act only if a listed version of request.form() limits silently ignored is installed.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.48%

Remediation

Version ranges on file

Affected products

pip starlette

### Summary accepts and to bound resource consumption while parsing form data. These limits are enforced for , but silently ignored for . An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. ### Details dispatches to a different parser depending on the . For the , , and limits are forwarded to the parser, but for the parser is constructed without them. It has no or parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies. Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects: - **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as ) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request. - **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the , forcing memory allocation proportional to the request body. The equivalent request is correctly rejected with / . ### Impact This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call on requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop. ### Mitigation Upgrade to a patched version, which forwards and to the url-encoded parser and enforces them while parsin