You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host.
Details
When a client requests a path that does not start with /:
GET@​google.com HTTP/1.1Host: localhost
affected versions reconstruct the URL as http://localhost@google.com. Per RFC 3986 §3.2.1, the substring before @ in the authority is userinfo, so re-parsing yields username = "localhost" and hostname = "google.com", with an empty path:
The root cause is that the path is concatenated directly after the host without a separating /, and without validating that it begins with one. Only the Host header was validated when constructing request.url; the path was not.
This requires an ASGI server that forwards a request-target lacking a leading / into scope["path"].
Impact
Any application running an affected version that uses request.url, request.url.netloc, or request.url.hostname for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first.
Note that this is less exploitable than GHSA-86qp-5c8j-p5mr: there, the poison is carried in the Host header, so the real path still routes to a valid endpoint while request.url.path lies. Here, the poison must be carried in the path itself, and that path (@google.com) does not match any registered route, so routing returns 404 and no endpoint handler runs. The exposure is limited to code that reads request.url before routing - notably middleware - or in 404/exception handlers.
Mitigation
Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields http://localhost/@​google.com with request.url.hostname == "localhost".
request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.
Details
request.form() dispatches to a different parser depending on the Content-Type. For multipart/form-data the max_files, max_fields, and max_part_size limits are forwarded to the parser, but for application/x-www-form-urlencoded the parser is constructed without them. It has no max_fields or max_part_size parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.
Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:
Field count drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as f0=v&f1=v&...) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.
Field size drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the FormData, forcing memory allocation proportional to the request body.
The equivalent multipart/form-data request is correctly rejected with 400 Too many fields / 400 Field exceeded maximum size.
Impact
This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call request.form() on application/x-www-form-urlencoded requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.
Mitigation
Upgrade to a patched version, which forwards max_fields and max_part_size to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match multipart/form-data (max_fields=1000, max_part_size=1MB) and can be customized via request.form(max_fields=..., max_part_size=...).
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer TIP This summary will be updated as you push new changes.
renovateBot
changed the title
chore(deps): update dependency starlette to v1.3.1 [security]
chore(deps): update dependency starlette to v1.3.1 [security] - autoclosed
Jun 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency file
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.2.1→1.3.1Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
CVE-2026-54282 / GHSA-jp82-jpqv-5vv3
More information
Details
Summary
In affected versions, the HTTP request path is not validated before being used to reconstruct
request.url. Becauserequest.urlis rebuilt by concatenating{scheme}://{host}{path}and re-parsing the result, a path that does not begin with/(for example@google.com) moves the authority boundary during re-parsing, sorequest.url.hostnameandrequest.url.netlocbecome attacker-controlled. Code that readsrequest.url.hostname(rather than theHostheader orscope) can therefore be misled into trusting an attacker-supplied host.Details
When a client requests a path that does not start with
/:affected versions reconstruct the URL as
http://localhost@google.com. Per RFC 3986 §3.2.1, the substring before@in the authority isuserinfo, so re-parsing yieldsusername = "localhost"andhostname = "google.com", with an empty path:The root cause is that the path is concatenated directly after the host without a separating
/, and without validating that it begins with one. Only theHostheader was validated when constructingrequest.url; the path was not.This requires an ASGI server that forwards a request-target lacking a leading
/intoscope["path"].Impact
Any application running an affected version that uses
request.url,request.url.netloc, orrequest.url.hostnamefor a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first.Note that this is less exploitable than GHSA-86qp-5c8j-p5mr: there, the poison is carried in the
Hostheader, so the real path still routes to a valid endpoint whilerequest.url.pathlies. Here, the poison must be carried in the path itself, and that path (@google.com) does not match any registered route, so routing returns404and no endpoint handler runs. The exposure is limited to code that readsrequest.urlbefore routing - notably middleware - or in 404/exception handlers.Mitigation
Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields
http://localhost/@​google.comwithrequest.url.hostname == "localhost".Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
CVE-2026-54283 / GHSA-82w8-qh3p-5jfq
More information
Details
Summary
request.form()acceptsmax_fieldsandmax_part_sizeto bound resource consumption while parsing form data. These limits are enforced formultipart/form-data, but silently ignored forapplication/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.Details
request.form()dispatches to a different parser depending on theContent-Type. Formultipart/form-datathemax_files,max_fields, andmax_part_sizelimits are forwarded to the parser, but forapplication/x-www-form-urlencodedthe parser is constructed without them. It has nomax_fieldsormax_part_sizeparameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:
f0=v&f1=v&...) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.FormData, forcing memory allocation proportional to the request body.The equivalent
multipart/form-datarequest is correctly rejected with400 Too many fields/400 Field exceeded maximum size.Impact
This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call
request.form()onapplication/x-www-form-urlencodedrequests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.Mitigation
Upgrade to a patched version, which forwards
max_fieldsandmax_part_sizeto the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults matchmultipart/form-data(max_fields=1000,max_part_size=1MB) and can be customized viarequest.form(max_fields=..., max_part_size=...).Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
Kludex/starlette (starlette)
v1.3.1: Version 1.3.1Compare Source
What's Changed
StarletteDeprecationWarninginstead ofDeprecationWarningby @Kludex in #3119max_fieldsandmax_part_sizeinFormParserby @Kludex in #3329FormParserlimits in parser callbacks by @Kludex in #3331Full Changelog: Kludex/starlette@1.3.0...1.3.1
v1.3.0: Version 1.3.0Compare Source
What's Changed
FileResponseby @jiyujie2006 in #3307OSErroralongsideMultiPartExceptionwhen closing temp files by @N3XT3R1337 in #3191httpx2to thefullextra by @Kludex in #3323removeprefixto strip weak ETag indicator inis_not_modifiedby @gnosyslambda in #3193request.urlfrom structured components by @Kludex in #3326New Contributors
Full Changelog: Kludex/starlette@1.2.1...1.3.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.