Vulnerability-Lookup

GCVE-1988-2026-0526

Vulnerability from gna-1988 – Published: 2026-11-02 09:47 – Updated: 2026-11-02 09:47

Title

[Bugtraq] [SECURITY] [DSA 6478-1] starlette security update

Summary

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6478-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso August 30, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : starlette CVE ID : CVE-2026-48817 CVE-2026-54282 CVE-2026-54283 Debian Bug : 1140631 1140632 Several vulnerabilities were discovered in starlette, a lightweight ASGI framework/toolkit, which could result in bypass of authorization checks or denial of service. For the stable distribution (trixie), these problems have been fixed in version 0.46.1-3+deb13u3. We recommend that you upgrade your starlette packages. For the detailed security status of starlette please refer to its security tracker page at: https://security-tracker.debian.org/tracker/starlette Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqUf5hfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TkDg//WFk1J1LeVPjk4OMOYjaIJcVDKqTBkdwGb86CcxUABGmyhIfc/fvfrbqI od/LPeB9j+BQ4ERpbInBZ4tdTzkhFGPrWi4qbc9RVg0CXLrSpn1kWG185G4XTgg7 srQEYRkvTi0zRvyXZY1g8lBtQ6d+CCLkgxHj3HDbiNgS3odcHlRmdf0JLghM4qUO Zyon8Bfl0+QJCpfbtoOCch2Z5PQ+7eQsNgm8VqUJmxb0wMyUWqJVxE/Ds75ZbE1/ eQNjIWbwmMLwpCg6gGCVyWWrKUXK4iQdLgb9NE97VHEejLvJhw0OS5a9XRbmi4JR 4JKO8PnY3uoh9DMmCM2ppck70V/jYFnxkc27Z9tjM5C348o3hRQYZbkL4wTqzQ94 TI6jeLBsvM2jKKawOWCdgq79sRlGLbYvhlxhLwoUa+NHcyjd+uc9wgcK6aSE21IC q17YMae4R1VP0I2dsJEca6+yEYsF5S68k98UH34zrMU1mP0cCO2mnpSTZbyUShf1 Vk1Eg4UoUE9CqxUFkXNawiJ6MZ/ajLJCfj0KqshsdlXZcAi1Zvs4mYvbwOSZTk4c ECH+Olc9RmO2P/9OiPeQm2hMpwqYedY5vjHZudkaJBBMj8812aMdOiuGD5ZTS1Fv etb6ahBWUG4IW6SXpIXFMNE79bpKRdBfl97rSyRENypCUi0pyA8= =lp7x -----END PGP SIGNATURE-----

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA GNA-1988

GNA scorecard E 38/100 over 576 records in the last 180 days details

References

5 references

URL	Tags
https://vuln.freearchive.org/archive/item/682f6b1…	technical-description
https://lists.securityfocus.com/hyperkitty/list/b…	technical-description
https://security-tracker.debian.org/tracker/starlette
https://www.debian.org/security/
https://www.debian.org/security/faq

Impacted products

1 product

Vendor	Product	Version	CPE status
unknown	starlette security update	Affected: unknown	guessed

Credits

Salvatore Bonaccorso

Relationships

reference GCVE-1988-2026-0526 (this record)

related CVE-2026-48817
related CVE-2026-54282
related CVE-2026-54283

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "starlette security update",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Salvatore Bonaccorso"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-6478-1                   security@debian.org\nhttps://www.debian.org/security/                     Salvatore Bonaccorso\nAugust 30, 2026                       https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\nPackage        : starlette\nCVE ID         : CVE-2026-48817 CVE-2026-54282 CVE-2026-54283\nDebian Bug     : 1140631 1140632\nSeveral vulnerabilities were discovered in starlette, a lightweight ASGI\nframework/toolkit, which could result in bypass of authorization checks\nor denial of service.\nFor the stable distribution (trixie), these problems have been fixed in\nversion 0.46.1-3+deb13u3.\nWe recommend that you upgrade your starlette packages.\nFor the detailed security status of starlette please refer to its\nsecurity tracker page at:\nhttps://security-tracker.debian.org/tracker/starlette\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\niQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmqUf5hfFIAAAAAALgAo\naXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2\nNDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND\nz0TkDg//WFk1J1LeVPjk4OMOYjaIJcVDKqTBkdwGb86CcxUABGmyhIfc/fvfrbqI\nod/LPeB9j+BQ4ERpbInBZ4tdTzkhFGPrWi4qbc9RVg0CXLrSpn1kWG185G4XTgg7\nsrQEYRkvTi0zRvyXZY1g8lBtQ6d+CCLkgxHj3HDbiNgS3odcHlRmdf0JLghM4qUO\nZyon8Bfl0+QJCpfbtoOCch2Z5PQ+7eQsNgm8VqUJmxb0wMyUWqJVxE/Ds75ZbE1/\neQNjIWbwmMLwpCg6gGCVyWWrKUXK4iQdLgb9NE97VHEejLvJhw0OS5a9XRbmi4JR\n4JKO8PnY3uoh9DMmCM2ppck70V/jYFnxkc27Z9tjM5C348o3hRQYZbkL4wTqzQ94\nTI6jeLBsvM2jKKawOWCdgq79sRlGLbYvhlxhLwoUa+NHcyjd+uc9wgcK6aSE21IC\nq17YMae4R1VP0I2dsJEca6+yEYsF5S68k98UH34zrMU1mP0cCO2mnpSTZbyUShf1\nVk1Eg4UoUE9CqxUFkXNawiJ6MZ/ajLJCfj0KqshsdlXZcAi1Zvs4mYvbwOSZTk4c\nECH+Olc9RmO2P/9OiPeQm2hMpwqYedY5vjHZudkaJBBMj8812aMdOiuGD5ZTS1Fv\netb6ahBWUG4IW6SXpIXFMNE79bpKRdBfl97rSyRENypCUi0pyA8=\n=lp7x\n-----END PGP SIGNATURE-----"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T09:47:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/item/682f6b1809b9970368b4464f49972e22e235be64328111093eda05351711f4fd"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/6WKTDI42GI7GC2PUJ4GV3ABRFKGWIZY2/"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/starlette"
        },
        {
          "url": "https://www.debian.org/security/"
        },
        {
          "url": "https://www.debian.org/security/faq"
        }
      ],
      "source": {
        "defect": [
          "E1x0ktc-0000000Bekc-0Iyv%40seger.debian.org"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Bugtraq] [SECURITY] [DSA 6478-1] starlette security update",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-48817",
              "type": "related"
            },
            {
              "destId": "CVE-2026-54282",
              "type": "related"
            },
            {
              "destId": "CVE-2026-54283",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0526",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/item/682f6b1809b9970368b4464f49972e22e235be64328111093eda05351711f4fd",
            "automated": true,
            "contentSha256": "682f6b1809b9970368b4464f49972e22e235be64328111093eda05351711f4fd",
            "evidenceScore": 6,
            "messageId": "E1x0ktc-0000000Bekc-0Iyv%40seger.debian.org",
            "originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/6WKTDI42GI7GC2PUJ4GV3ABRFKGWIZY2/",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-11-02T09:47:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0526"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T09:47:21Z",
    "dateUpdated": "2026-11-02T09:47:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0526"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48817 (GCVE-0-2026-48817)

Vulnerability from cvelistv5 – Published: 2026-06-17 19:48 – Updated: 2026-06-18 13:54

Title

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

Summary

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-18 13:49 UTC

CWE

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7831 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Kludex/starlette/security/advi…	x_refsource_CONFIRM
https://github.com/Kludex/starlette/releases/tag/1.1.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Kludex	starlette	Affected: < 1.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48817",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T13:49:36.586536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T13:54:23.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "starlette",
          "vendor": "Kludex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T19:48:03.441Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c"
        },
        {
          "name": "https://github.com/Kludex/starlette/releases/tag/1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Kludex/starlette/releases/tag/1.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x746-7m8f-x49c",
        "discovery": "UNKNOWN"
      },
      "title": "Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48817",
    "datePublished": "2026-06-17T19:48:03.441Z",
    "dateReserved": "2026-05-22T20:57:10.976Z",
    "dateUpdated": "2026-06-18T13:54:23.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54282 (GCVE-0-2026-54282)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:45 – Updated: 2026-06-22 17:26

Title

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

Summary

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:26 UTC

CWE

CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7831 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Kludex/starlette/security/advi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Kludex	starlette	Affected: < 1.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54282",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:26:39.551031Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:26:58.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "starlette",
          "vendor": "Kludex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:45:01.629Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3"
        }
      ],
      "source": {
        "advisory": "GHSA-jp82-jpqv-5vv3",
        "discovery": "UNKNOWN"
      },
      "title": "Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54282",
    "datePublished": "2026-06-22T16:45:01.629Z",
    "dateReserved": "2026-06-12T17:46:37.292Z",
    "dateUpdated": "2026-06-22T17:26:58.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54283 (GCVE-0-2026-54283)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:46 – Updated: 2026-06-23 16:10

Title

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Summary

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 16:06 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7831 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Kludex/starlette/security/advi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Kludex	starlette	Affected: >= 0.4.1, < 1.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54283",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T16:06:30.546768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T16:10:51.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "starlette",
          "vendor": "Kludex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.4.1, \u003c 1.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. This vulnerability is fixed in 1.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T16:46:16.706Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq"
        }
      ],
      "source": {
        "advisory": "GHSA-82w8-qh3p-5jfq",
        "discovery": "UNKNOWN"
      },
      "title": "Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54283",
    "datePublished": "2026-06-22T16:46:16.706Z",
    "dateReserved": "2026-06-12T17:46:37.292Z",
    "dateUpdated": "2026-06-23T16:10:51.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GCVE-1988-2026-0526

CVE-2026-48817 (GCVE-0-2026-48817)

CVE-2026-54282 (GCVE-0-2026-54282)

CVE-2026-54283 (GCVE-0-2026-54283)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour