CVE-2026-54283Disclosure(encode / starlette)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch encode starlette systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

encode CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

starlette

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 3d ago at 1 mentions (2026-06-15); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

encode

Products

starlette

Deep dive

Activity timeline4 mentions / 4d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-15	1	Disclosure1
2026-06-16	1	General1
2026-06-24	1	Patch1
2026-08-26	1	Disclosure1

Full discourse4 posts

المحارب🏆🇦🇪🇪🇬@nike4942467d
Disclosure
🚨 ثغرة أمنية جديدة في مكتبة Starlette / FastAPI تؤدي لإنهاك الموارد وعطل الخدمة (Denial of Service - DoS) عبر التجاوز لـ request.form() Limit Bypass. مُسجلة برقم: CVE-2026-54283 الخطورة: P2 / S2 المُبلغ: @nike49424
Post summary
A newly disclosed vulnerability (CVE‑2026‑54283) in Starlette/FastAPI enables DoS by bypassing request.form() limits; no PoC, exploit or patch details were provided, nor any reports of active exploitation.
1000050
52 followersView on X
RazzReport@RazzReport130d
Patch
@LiteLLM @vllm_project OpenHands/OpenHands: four CVEs patched in coordinated response - CVE-2026-54283, CVE-2026-8723, CVE-2026-41691, GHSA-jm82-fx9c-mx94. Security branches pushed simultaneously this window. Self-hosted agent runtime operators should patch before release propagates.
Post summary
The tweet announces that four CVEs have been patched in a coordinated effort and urges users to update before the release propagates.
1000052
14 followersView on X
المحارب🏆🇦🇪🇪🇬@nike49424139d
General
اردو الاختبار ونجحنا ✅ CVE‑2026‑54283 تم تنفيذ اختبار كامل داخل درع زايد بنجاح. النتيجة: النظام صدّ الهجوم، أغلق الثغرة، وأعلن الضوء الأخضر. 🛡️ ZAID SHIELD — GREEN LIGHT الان هي في ملف CVE-2026-54283.md 👇 https://github.com/asrarmared-ship-it/advisory-database.git https://codeberg.org/nike49424/Zayed-Shield.git #ZayedShield https://t.co/uw1KjP4PWe
Post summary
The post announces that a comprehensive internal test of CVE-2026-54283 was successful, with the flaw being neutralized. No external exploits, patches, or detailed technical info are disclosed, making it a general update rather than a specific disclosure or exploit announcement.
1000050
52 followersView on X
DailyCVE@dailycve139d
Disclosure
🔴 Starlette/FastAPI, Denial of Service (DoS) via Limits Bypass, #CVE-2026-54283 (High) -DC-Jun2026-445 https://dailycve.com/starlette-fastapi-denial-of-service-dos-via-limits-bypass-cve-2026-54283-high-dc-jun2026-445/
Post summary
A new high‑severity denial‑of‑service vulnerability (CVE‑2026‑54283) has been identified in Starlette/FastAPI, triggered by limits bypass, with no disclosed exploitation or patch details.
0000039
212 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	encode	starlette	-	python	-

Explore more

Back to dashboard encode CVEs starlette vulnerabilities

What researchers are saying

CVE-2026-54283

المحارب🏆🇦🇪🇪🇬@nike49424Disclosure

A newly disclosed vulnerability (CVE‑2026‑54283) in Starlette/FastAPI enables DoS by bypassing request.form() limits; no PoC, exploit or patch details were provided, nor any reports of active exploitation.

RazzReport@RazzReportPatch

The tweet announces that four CVEs have been patched in a coordinated effort and urges users to update before the release propagates.

المحارب🏆🇦🇪🇪🇬@nike49424General

The post announces that a comprehensive internal test of CVE-2026-54283 was successful, with the flaw being neutralized. No external exploits, patches, or detailed technical info are disclosed, making it a general update rather than a specific disclosure or exploit announcement.

DailyCVE@dailycveDisclosure

A new high‑severity denial‑of‑service vulnerability (CVE‑2026‑54283) has been identified in Starlette/FastAPI, triggered by limits bypass, with no disclosed exploitation or patch details.