Read the docs
TI-2026-39183 Aliases CVE-2026-54283GHSA-82w8-qh3p-5jfq

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Priority LOW 39CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00481 41st percentileScored 2026-11-07
Fix Partial starlette (Kludex): 1.3.1starlette (PyPI): 1.3.1Red Hat: 23 advisoriesRed Hat: 10 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kludexstarlette0.4.1 to before 1.3.11.3.1Patch availableCNA
—starlette (PyPI)0.4.1 to before 1.3.11.3.1Patch availableGHSA-82w8-qh3p-5jfq
  • starlette VendorKludex Affected 0.4.1 to before 1.3.1 Fixed in 1.3.1 Patch available CNA
  • starlette (PyPI) Vendor— Affected 0.4.1 to before 1.3.1 Fixed in 1.3.1 Patch available GHSA-82w8-qh3p-5jfq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*0.4.1 to before 1.3.1Vulnerableencode
  • cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* Versions 0.4.1 to before 1.3.1 Vulnerable ·encode

Remediation

  • Fix · CNA starlette (Kludex) Fixed in 1.3.1
  • Fix · GHSA-82w8-qh3p-5jfq starlette (PyPI) Fixed in 1.3.1 Advisory →

Red Hat 23 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:76150 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Show 20 more Red Hat advisories
  • RHSA-2026:76149 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.4.5 security update
    • Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:70995 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:70979 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:70969 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:70965 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:69469 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:69467 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:69466 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:69464 Released 2026-09-21 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:50479 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:50340 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
  • RHSA-2026:44696 Released 2026-07-23 · Red Hat rating Important
    satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9
  • RHSA-2026:43038 Released 2026-07-21 · Red Hat rating Critical
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
  • RHSA-2026:42142 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
  • RHSA-2026:42132 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:36006 Released 2026-07-06 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:36005 Released 2026-07-06 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat AI Inference Server 3.2Fixed RHSA-2026:36005, RHSA-2026:36006, RHSA-2026:61627
Red Hat AI Inference Server 3.4Fixed RHSA-2026:69464, RHSA-2026:69466, RHSA-2026:69467, RHSA-2026:69469, RHSA-2026:70965, RHSA-2026:70969, RHSA-2026:70979, RHSA-2026:70995
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:42132, RHSA-2026:50479
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:42142, RHSA-2026:50340
Red Hat Enterprise Linux AI 3.4Fixed RHSA-2026:76149, RHSA-2026:76150
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:43038
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat Satellite 6.17Fixed RHSA-2026:44696
Not affected: 11 products
  • OpenShift Lightspeed
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Enterprise Linux command line assistant
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54283
  2. 2026-10-03 Alias added: GHSA-82w8-qh3p-5jfq
  3. 2026-10-06 Fix available: RHSA-2026:76149 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76150 · Red Hat
  5. 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.4 · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  7. 2026-10-07 Affected versions changed · Red Hat
  8. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  9. 2026-10-20 Affected versions changed · Red Hat
  10. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  11. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat

References

Advisory 1

Other 1

  • TI-2025-38917 Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse CVSS 3.1HIGH 7.5
  • TI-2026-30841 Python-Multipart: Denial of Service via unbounded multipart part headers CVSS 3.1HIGH 7.5
  • TI-2024-36140 python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences