Threats tagged 'brew-mcp-proxy-cve-2026-54283'

Starlette's request.form() method does not enforce configured limits on max_fields and max_part_size for application/x-www-form-urlencoded content types, allowing an attacker to send requests with an arbitrarily large number of fields or very large fields. This can cause denial of service by blocking the event loop or exhausting memory. The issue affects versions from 0.8.2 up to but not including 0.12.0_2. A patch is available in version 0.12.0_2 that enforces these limits for url-encoded bodies.