This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [starlette](https://redirect.github.com/Kludex/starlette) ([changelog](https://starlette.dev/release-notes/)) | `1.2.1` → `1.3.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/starlette/1.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/starlette/1.2.1/1.3.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/357) for more information. --- ### Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname [CVE-2026-54282](https://nvd.nist.gov/vuln/detail/CVE-2026-54282) / [GHSA-jp82-jpqv-5vv3](https://redirect.github.com/advisories/GHSA-jp82-jpqv-5vv3) <details> <summary>More information</summary> #### Details ##### Summary In affected versions, the HTTP request path is not validated before being used to reconstruct `request.url`. Because `request.url` is rebuilt by concatenating `{scheme}://{host}{path}` and re-parsing the result, a path that does not begin with `/` (for example `@google.com`) moves the authority boundary during re-parsing, so `request.url.hostname` and `request.url.netloc` become attacker-controlled. Code that reads `request.url.hostname` (rather than the `Host` header or `scope`) can therefore be misled into trusting an attacker-supplied host. ##### Details When a client requests a path that does not start with `/`: ```http GET @google.com HTTP/1.1 Host: localhost ``` affected versions reconstruct the URL as `http://localhost@google.com`. Per [RFC 3986 §3.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1), the substring before `@` in the authority is `userinfo`, so re-parsing yields `username = "localhost"` and `hostname = "google.com"`, with an empty path: ```text request.url == "http://localhost@google.com" request.url.hostname == "google.com" request.url.path == "" ``` The root cause is that the path is concatenated directly after the host without a separating `/`, and without validating that it begins with one. Only the `Host` header was validated when constructing `request.url`; the path was not. This requires an ASGI server that forwards a request-target lacking a leading `/` into `scope["path"]`. ##### Impact Any application running an affected version that uses `request.url`, `request.url.netloc`, or `request.url.hostname` for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first. Note that this is less exploitable than [GHSA-86qp-5c8j-p5mr](https://redirect.github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr): there, the poison is carried in the `Host` header, so the real path still routes to a valid endpoint while `request.url.path` lies. Here, the poison must be carried in the path itself, and that path (`@google.com`) does not match any registered route, so routing returns `404` and no endpoint handler runs. The exposure is limited to code that reads `request.url` before routing - notably middleware - or in 404/exception handlers. ##### Mitigation Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields `http://localhost/@google.com` with `request.url.hostname == "localhost"`. #### Severity - CVSS Score: 3.7 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N` #### References - [https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3](https://redirect.github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3) - [https://github.com/advisories/GHSA-jp82-jpqv-5vv3](https://redirect.github.com/advisories/GHSA-jp82-jpqv-5vv3) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-jp82-jpqv-5vv3) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS [CVE-2026-54283](https://nvd.nist.gov/vuln/detail/CVE-2026-54283) / [GHSA-82w8-qh3p-5jfq](https://redirect.github.com/advisories/GHSA-82w8-qh3p-5jfq) <details> <summary>More information</summary> #### Details ##### Summary `request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. ##### Details `request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded` the parser is constructed without them. It has no `max_fields` or `max_part_size` parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies. Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects: - **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as `f0=v&f1=v&...`) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request. - **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the `FormData`, forcing memory allocation proportional to the request body. The equivalent `multipart/form-data` request is correctly rejected with `400 Too many fields` / `400 Field exceeded maximum size`. ##### Impact This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call `request.form()` on `application/x-www-form-urlencoded` requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop. ##### Mitigation Upgrade to a patched version, which forwards `max_fields` and `max_part_size` to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match `multipart/form-data` (`max_fields=1000`, `max_part_size=1MB`) and can be customized via `request.form(max_fields=..., max_part_size=...)`. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq](https://redirect.github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq) - [https://github.com/advisories/GHSA-82w8-qh3p-5jfq](https://redirect.github.com/advisories/GHSA-82w8-qh3p-5jfq) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-82w8-qh3p-5jfq) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname [CVE-2026-54282](https://nvd.nist.gov/vuln/detail/CVE-2026-54282) / [GHSA-jp82-jpqv-5vv3](https://redirect.github.com/advisories/GHSA-jp82-jpqv-5vv3) <details> <summary>More information</summary> #### Details ##### Summary In affected versions, the HTTP request path is not validated before being used to reconstruct `request.url`. Because `request.url` is rebuilt by concatenating `{scheme}://{host}{path}` and re-parsing the result, a path that does not begin with `/` (for example `@google.com`) moves the authority boundary during re-parsing, so `request.url.hostname` and `request.url.netloc` become attacker-controlled. Code that reads `request.url.hostname` (rather than the `Host` header or `scope`) can therefore be misled into trusting an attacker-supplied host. ##### Details When a client requests a path that does not start with `/`: ```http GET @google.com HTTP/1.1 Host: localhost ``` affected versions reconstruct the URL as `http://localhost@google.com`. Per [RFC 3986 §3.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1), the substring before `@` in the authority is `userinfo`, so re-parsing yields `username = "localhost"` and `hostname = "google.com"`, with an empty path: ```text request.url == "http://localhost@google.com" request.url.hostname == "google.com" request.url.path == "" ``` The root cause is that the path is concatenated directly after the host without a separating `/`, and without validating that it begins with one. Only the `Host` header was validated when constructing `request.url`; the path was not. This requires an ASGI server that forwards a request-target lacking a leading `/` into `scope["path"]`. ##### Impact Any application running an affected version that uses `request.url`, `request.url.netloc`, or `request.url.hostname` for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first. Note that this is less exploitable than [GHSA-86qp-5c8j-p5mr](https://redirect.github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr): there, the poison is carried in the `Host` header, so the real path still routes to a valid endpoint while `request.url.path` lies. Here, the poison must be carried in the path itself, and that path (`@google.com`) does not match any registered route, so routing returns `404` and no endpoint handler runs. The exposure is limited to code that reads `request.url` before routing - notably middleware - or in 404/exception handlers. ##### Mitigation Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields `http://localhost/@google.com` with `request.url.hostname == "localhost"`. #### Severity - CVSS Score: 3.7 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N` #### References - [https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3](https://redirect.github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3) - [https://github.com/Kludex/starlette](https://redirect.github.com/Kludex/starlette) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS [CVE-2026-54283](https://nvd.nist.gov/vuln/detail/CVE-2026-54283) / [GHSA-82w8-qh3p-5jfq](https://redirect.github.com/advisories/GHSA-82w8-qh3p-5jfq) <details> <summary>More information</summary> #### Details ##### Summary `request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. ##### Details `request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded` the parser is constructed without them. It has no `max_fields` or `max_part_size` parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies. Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects: - **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as `f0=v&f1=v&...`) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request. - **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the `FormData`, forcing memory allocation proportional to the request body. The equivalent `multipart/form-data` request is correctly rejected with `400 Too many fields` / `400 Field exceeded maximum size`. ##### Impact This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call `request.form()` on `application/x-www-form-urlencoded` requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop. ##### Mitigation Upgrade to a patched version, which forwards `max_fields` and `max_part_size` to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match `multipart/form-data` (`max_fields=1000`, `max_part_size=1MB`) and can be customized via `request.form(max_fields=..., max_part_size=...)`. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq](https://redirect.github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq) - [https://github.com/Kludex/starlette](https://redirect.github.com/Kludex/starlette) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-82w8-qh3p-5jfq) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>Kludex/starlette (starlette)</summary> ### [`v1.3.1`](https://redirect.github.com/Kludex/starlette/releases/tag/1.3.1): Version 1.3.1 [Compare Source](https://redirect.github.com/Kludex/starlette/compare/1.3.0...1.3.1) #### What's Changed - Use `StarletteDeprecationWarning` instead of `DeprecationWarning` by [@Kludex](https://redirect.github.com/Kludex) in [#3119](https://redirect.github.com/Kludex/starlette/pull/3119) - Enforce `max_fields` and `max_part_size` in `FormParser` by [@Kludex](https://redirect.github.com/Kludex) in [#3329](https://redirect.github.com/Kludex/starlette/pull/3329) - Enforce `FormParser` limits in parser callbacks by [@Kludex](https://redirect.github.com/Kludex) in [#3331](https://redirect.github.com/Kludex/starlette/pull/3331) **Full Changelog**: <Kludex/starlette@1.3.0...1.3.1> ### [`v1.3.0`](https://redirect.github.com/Kludex/starlette/releases/tag/1.3.0): Version 1.3.0 [Compare Source](https://redirect.github.com/Kludex/starlette/compare/1.2.1...1.3.0) #### What's Changed - Clamp oversized suffix ranges in `FileResponse` by [@jiyujie2006](https://redirect.github.com/jiyujie2006) in [#3307](https://redirect.github.com/Kludex/starlette/pull/3307) - Catch `OSError` alongside `MultiPartException` when closing temp files by [@N3XT3R1337](https://redirect.github.com/N3XT3R1337) in [#3191](https://redirect.github.com/Kludex/starlette/pull/3191) - Add `httpx2` to the `full` extra by [@Kludex](https://redirect.github.com/Kludex) in [#3323](https://redirect.github.com/Kludex/starlette/pull/3323) - Adjust testclient typing and warnings by [@waketzheng](https://redirect.github.com/waketzheng) in [#3322](https://redirect.github.com/Kludex/starlette/pull/3322) - Fix IndexError in URL.replace() on a URL with no authority by [@LeSingh1](https://redirect.github.com/LeSingh1) in [#3317](https://redirect.github.com/Kludex/starlette/pull/3317) - Annotate URLPath protocol parameter with Literal by [@Chang-LeHung](https://redirect.github.com/Chang-LeHung) in [#3285](https://redirect.github.com/Kludex/starlette/pull/3285) - avoid collapsing exception groups from user code by [@graingert](https://redirect.github.com/graingert) in [#2830](https://redirect.github.com/Kludex/starlette/pull/2830) - Use `removeprefix` to strip weak ETag indicator in `is_not_modified` by [@gnosyslambda](https://redirect.github.com/gnosyslambda) in [#3193](https://redirect.github.com/Kludex/starlette/pull/3193) - Build `request.url` from structured components by [@Kludex](https://redirect.github.com/Kludex) in [#3326](https://redirect.github.com/Kludex/starlette/pull/3326) #### New Contributors - [@jiyujie2006](https://redirect.github.com/jiyujie2006) made their first contribution in [#3307](https://redirect.github.com/Kludex/starlette/pull/3307) - [@N3XT3R1337](https://redirect.github.com/N3XT3R1337) made their first contribution in [#3191](https://redirect.github.com/Kludex/starlette/pull/3191) - [@leestana01](https://redirect.github.com/leestana01) made their first contribution in [#3319](https://redirect.github.com/Kludex/starlette/pull/3319) - [@LeSingh1](https://redirect.github.com/LeSingh1) made their first contribution in [#3317](https://redirect.github.com/Kludex/starlette/pull/3317) - [@EmmanuelNiyonshuti](https://redirect.github.com/EmmanuelNiyonshuti) made their first contribution in [#3204](https://redirect.github.com/Kludex/starlette/pull/3204) - [@Chang-LeHung](https://redirect.github.com/Chang-LeHung) made their first contribution in [#3285](https://redirect.github.com/Kludex/starlette/pull/3285) - [@gnosyslambda](https://redirect.github.com/gnosyslambda) made their first contribution in [#3193](https://redirect.github.com/Kludex/starlette/pull/3193) **Full Changelog**: <Kludex/starlette@1.2.1...1.3.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vortex-data/vortex).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>