CVE-2026-54283: falha de alta gravidade em Kludex starlette
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Kludex · starletteCVEs relacionadas — Kludex starlette
No mesmo produto, das mais perigosas para as menos.
CVE-2026-48710MEDIUMStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksEPSS 70.3%KEVCVE-2025-62727HIGHStarlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponseEPSS 0.8%CVE-2026-48818HIGHStarlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on WindowsEPSS 0.4%CVE-2026-54282LOWStarlette: Unvalidated request path concatenated into authority poisons request.url.hostnameEPSS 0.3%CVE-2026-48817MEDIUMStarlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`EPSS 0.2%