chore(deps): update dependency starlette to v1.3.1 [security]

[a-klos]

This PR contains the following updates:

Package	Change	Age	Confidence
starlette (changelog)	1.2.1 -> 1.3.1

GitHub Vulnerability Alerts

CVE-2026-54282

Summary

In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host.

Details

When a client requests a path that does not start with /:

GET @​google.com HTTP/1.1
Host: localhost

affected versions reconstruct the URL as http://localhost@google.com. Per RFC 3986 §3.2.1, the substring before @ in the authority is userinfo, so re-parsing yields username = "localhost" and hostname = "google.com", with an empty path:

request.url          == "http://localhost@google.com"
request.url.hostname == "google.com"
request.url.path     == ""

The root cause is that the path is concatenated directly after the host without a separating /, and without validating that it begins with one. Only the Host header was validated when constructing request.url; the path was not.

This requires an ASGI server that forwards a request-target lacking a leading / into scope["path"].

Impact

Any application running an affected version that uses request.url, request.url.netloc, or request.url.hostname for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first.

Note that this is less exploitable than GHSA-86qp-5c8j-p5mr: there, the poison is carried in the Host header, so the real path still routes to a valid endpoint while request.url.path lies. Here, the poison must be carried in the path itself, and that path (@google.com) does not match any registered route, so routing returns 404 and no endpoint handler runs. The exposure is limited to code that reads request.url before routing - notably middleware - or in 404/exception handlers.

Mitigation

Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields http://localhost/@​google.com with request.url.hostname == "localhost".

CVE-2026-54283

Summary

request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.

Details

request.form() dispatches to a different parser depending on the Content-Type. For multipart/form-data the max_files, max_fields, and max_part_size limits are forwarded to the parser, but for application/x-www-form-urlencoded the parser is constructed without them. It has no max_fields or max_part_size parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.

Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:

• Field count drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as f0=v&f1=v&...) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.
• Field size drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the FormData, forcing memory allocation proportional to the request body.

The equivalent multipart/form-data request is correctly rejected with 400 Too many fields / 400 Field exceeded maximum size.

Impact

This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call request.form() on application/x-www-form-urlencoded requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.

Mitigation

Upgrade to a patched version, which forwards max_fields and max_part_size to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match multipart/form-data (max_fields=1000, max_part_size=1MB) and can be customized via request.form(max_fields=..., max_part_size=...).

---

Release Notes

Kludex/starlette (starlette)

v1.3.1: Version 1.3.1

Compare Source

What's Changed

• Use StarletteDeprecationWarning instead of DeprecationWarning by @​Kludex in #​3119
• Enforce max_fields and max_part_size in FormParser by @​Kludex in #​3329
• Enforce FormParser limits in parser callbacks by @​Kludex in #​3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

v1.3.0: Version 1.3.0

Compare Source

What's Changed

• Clamp oversized suffix ranges in FileResponse by @​jiyujie2006 in #​3307
• Catch OSError alongside MultiPartException when closing temp files by @​N3XT3R1337 in #​3191
• Add httpx2 to the full extra by @​Kludex in #​3323
• Adjust testclient typing and warnings by @​waketzheng in #​3322
• Fix IndexError in URL.replace() on a URL with no authority by @​LeSingh1 in #​3317
• Annotate URLPath protocol parameter with Literal by @​Chang-LeHung in #​3285
• avoid collapsing exception groups from user code by @​graingert in #​2830
• Use removeprefix to strip weak ETag indicator in is_not_modified by @​gnosyslambda in #​3193
• Build request.url from structured components by @​Kludex in #​3326

New Contributors

• @​jiyujie2006 made their first contribution in #​3307
• @​N3XT3R1337 made their first contribution in #​3191
• @​leestana01 made their first contribution in #​3319
• @​LeSingh1 made their first contribution in #​3317
• @​EmmanuelNiyonshuti made their first contribution in #​3204
• @​Chang-LeHung made their first contribution in #​3285
• @​gnosyslambda made their first contribution in #​3193

Full Changelog: Kludex/starlette@1.2.1...1.3.0

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.