Threats tagged 'brew-mcp-atlassian-cve-2026-54283'

Starlette's request.form() method does not enforce configured limits on the number and size of fields for application/x-www-form-urlencoded content types, unlike multipart/form-data. This allows unauthenticated attackers to send requests with an arbitrarily large number of fields or very large fields, causing denial of service by blocking the event loop or exhausting memory. The vulnerability affects versions from 0.11.9 up to but not including 0.21.1_8. A patched version 0.21.1_8 is available that enforces these limits properly.