Starlette vulnerabilities

4 known vulnerabilities in Starlette from Encode. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  starlette: Allocation of Resources Without Limits or Throttling

  CVE-2024-47874Oct 15, 2024Encode

  Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an

• 7.5 High severity

  python-multipart: Inefficient Regular Expression Complexity

  CVE-2024-24762Feb 5, 2024KludexEPSS 1.52%

  `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is ver

• 7.5 High severity

  Starlette: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2023-29159Jun 1, 2023EncodeEPSS 2.59%

  Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.

• 7.5 High severity

  Starlette: Uncontrolled Resource Consumption

  CVE-2023-30798Apr 21, 2023EncodeEPSS 1.3%

  There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the H