CVE-2026-54283: Starlette Form Parsing Bypass Allows Denial of Service

Technical summary

Starlette's request.form() method accepts max_fields and max_part_size parameters to constrain resource consumption during form parsing. These limits are correctly enforced for multipart/form-data payloads but are silently ignored for application/x-www-form-urlencoded content. This inconsistency creates a bypass where an unauthenticated remote attacker can send arbitrarily large or numerous fields in URL-encoded form bodies, bypassing the application's stated resource constraints and triggering denial-of-service conditions. The vulnerability stems from differential handling of two standard form encoding types without consistent boundary enforcement.

Business impact

Applications relying on Starlette's form parsing limits to prevent resource exhaustion are unexpectedly exposed to denial-of-service attacks via URL-encoded forms. This can cause application unavailability, performance degradation, or excessive memory consumption. Any internet-facing Starlette application—particularly APIs, web services, or form-heavy applications—becomes vulnerable to simple, unauthenticated attacks that bypass intended safeguards. The risk is heightened because the vulnerability is silent; developers may be unaware their limits are not working as expected.

Affected systems

Starlette versions 0.4.1 through 1.3.0 are affected. Applications using the request.form() method with max_fields or max_part_size configuration are at risk. The vulnerability affects any deployed Starlette-based application that receives untrusted form input, regardless of authentication model. This includes FastAPI applications that rely on Starlette's underlying form handling.

Exploitability

Exploitability is high. No authentication, special privileges, or user interaction is required. An attacker can craft a simple HTTP POST request with a URL-encoded body containing thousands of fields or extremely large field values and send it directly to a vulnerable endpoint. The attack is straightforward and requires minimal resources; standard HTTP tools can execute it. The only barrier is knowledge that the application uses Starlette and accepts form input.

Remediation

Upgrade Starlette to version 1.3.1 or later. This patch correctly enforces max_fields and max_part_size limits for both multipart/form-data and application/x-www-form-urlencoded payloads. Verify the upgrade is applied to all production instances and dependent frameworks like FastAPI that bundle Starlette. No workarounds are available for older versions; patching is the only mitigation.

Patch guidance

Update Starlette to version 1.3.1 or newer as soon as feasible. If using FastAPI or other frameworks that depend on Starlette, ensure those projects have released versions that include the patched Starlette dependency. Test the upgrade in a non-production environment first to verify form handling behavior remains consistent with your application's expectations. The fix is backward-compatible and should not require code changes.

Detection guidance

Monitor application logs and metrics for unusual patterns: sudden spikes in request processing time, memory consumption, or CPU usage tied to form submissions; requests with unusually large numbers of form fields; or requests to endpoints that accept form input with abnormally large payloads. Network-based detection can flag HTTP POST requests with exceptionally large application/x-www-form-urlencoded bodies or unusually high field counts. Review form-handling endpoints in your application code to identify which ones may be exposed.

Why prioritize this

This is a high-priority issue because it combines ease of exploitation (no authentication needed, simple HTTP request), direct denial-of-service impact on availability, and a fundamental bypass of administrator-configured resource controls. The silent failure of limits creates false confidence in security posture. Any internet-facing Starlette application should be treated as urgent.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required, resulting in high impact to availability. The attack vector is simple, complexity is low, and there is no requirement for privileges or user interaction. The scope is unchanged. The score does not award severity points for confidentiality or integrity because this is a denial-of-service vulnerability, but the availability impact is severe.

Frequently asked questions