There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts
    max_fields and max_part_size to bound resource consumption while parsing form data. These limits are
    enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An
    unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields
    or an arbitrarily large field, even when the application configured limits it believed would apply. This
    vulnerability is fixed in 1.3.1. (CVE-2026-54283)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Starlette 是一個輕量級的 ASGI 框架/工具包。From 0.4.1 until 1.3.1，request.form（） 接受max_fields，並在剖析表單資料時max_part_size繫結資源消耗。這些限制會針對 multipart/form-data 強制執行，但對於 application/x-www-form-urlencoded 會無訊息地忽略。因此，未經驗證的攻擊者可以傳送具有任意大量欄位或任意大欄位的 urlencoded 內文，即使應用程式設定了它認為會套用的限制也是如此。此弱點已在 1.3.1 中修正。(CVE-2026-54283)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Starlette 是一个轻量级 ASGI 框架/工具包。From 0.4.1 until 1.3.1， request.form（） 接受 max_fields 和 max_part_size 以在解析表单数据时限制资源消耗。这些限制对 multipart/form-data 执行，但对于 application/x-www-form-urlencoded 则静默忽略。因此，未经认证的攻击者可发送包含任意大量字段或任意大字段的 urlencoded 正文，即使应用程序配置了它认为适用的限制。此漏洞已在 1.3.1 中修复。(CVE-2026-54283)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Starlette は軽量の ASGI フレームワーク/ツールキットです。0.4.1から1.3.1まで、request.form() はフォームデータを解析しながら、max_fieldsを受け取り、リソース消費をmax_part_sizeします。これらの制限は、multipart/form-data に対して適用されますが、application/x-www-form-urlencoded に対しては無視されます。このため、認証されていない攻撃者が、アプリケーション構成の制限が適用されると思われる場合でも、任意の大きなフィールド数または任意の大きなフィールドを持つ urlencode された本文を送信する可能性があります。この脆弱性は 1.3.1 で修正されました。(CVE-2026-54283)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts     max_fields and max_part_size to bound resource consumption while parsing form data. These limits are     enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An     unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields     or an arbitrarily large field, even when the application configured limits it believed would apply. This     vulnerability is fixed in 1.3.1. (CVE-2026-54283)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4711 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4711-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     August 01, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : starlette     Version        : 0.26.1-1+deb12u2     CVE ID         : CVE-2026-48817 CVE-2026-54282 CVE-2026-54283     Debian Bug     : 1140631 1140632

    Multiple vulnerabilities were found in starlette, a lightweight ASGI     (Asynchronous Server Gateway Interface) framework/toolkit.

    CVE-2026-48817

       A vulnerability exists where an HTTPEndpoint subclass is registered        through Route() without an explicit methods argument, and the route        does not constrain the method and every method reaches the endpoint.

    CVE-2026-54282

       A vulnerability exists where the HTTP request path is not validated        before being used to reconstruct request.url which can poison        request.url.hostname and request.url.netloc.

    CVE-2026-54283

       The max_fields and max_part_size limits for request.form() are enforced        for multipart/form-data, but silently ignored for application/x-www-        form-urlencoded.

    For Debian 12 bookworm, these problems have been fixed in version     0.26.1-1+deb12u2.

    We recommend that you upgrade your starlette packages.

    For the detailed security status of starlette please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/starlette

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
443221	SCA: security update for starlette (GHSA-82w8-qh3p-5jfq)	Tenable Self-Hosted Container Security	SCA Checks	2026/6/16	2026/7/6	high
443221	SCA: security update for starlette (GHSA-82w8-qh3p-5jfq)	Tenable Cloud Security	SCA Checks	2026/6/16	2026/7/6	high
322131	Linux Distros 未修補弱點：CVE-2026-54283	Nessus	Misc.	2026/6/22	2026/8/2	high
322131	Linux Distros 未修补的漏洞：CVE-2026-54283	Nessus	Misc.	2026/6/22	2026/8/2	high
322131	Linux Distros のパッチ未適用の脆弱性: CVE-2026-54283	Nessus	Misc.	2026/6/22	2026/8/2	high
322131	Linux Distros Unpatched Vulnerability : CVE-2026-54283	Nessus	Misc.	2026/6/22	2026/8/2	high
331605	Debian dla-4711 : python3-starlette - security update	Nessus	Debian Local Security Checks	2026/8/2	2026/8/2	medium

检测

插件搜索

high

high

high

high

high

high

medium