starlette
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 20 advisory(ies) without a verdict
Advisories (20)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2c2j-9gv5-cj73 Starlette has possible denial-of-service vector when parsing large files in multipart forms | < 0.47.2 | Undetermined |
| GHSA-74m5-2c7w-9w3x MultipartParser denial of service with too many fields or files | < 0.25.0 | Undetermined |
| GHSA-7f5h-v6xp-fcq8 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` | 0.39.0 – < 0.49.1 | Undetermined |
| GHSA-82w8-qh3p-5jfq Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS | 0.4.1 – < 1.3.1 | Undetermined |
| GHSA-86qp-5c8j-p5mr Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks | < 1.0.1 | Undetermined |
| GHSA-f96h-pmfr-66vw Starlette Denial of service (DoS) via multipart/form-data | < 0.40.0 | Undetermined |
| GHSA-jp82-jpqv-5vv3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname | < 1.3.0 | Undetermined |
| GHSA-v5gw-mw7f-84px Starlette has Path Traversal vulnerability in StaticFiles | 0.13.5 – < 0.27.0 | Undetermined |
| GHSA-wqp7-x3pw-xc5r Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows | < 1.1.0 | Undetermined |
| GHSA-x746-7m8f-x49c Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` | < 1.1.0 | Undetermined |
| PYSEC-2023-48 There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of | < 8c74c2c8dba7030154f8af18e016136bea1938fa ; < 0.25.0 | Undetermined |
| PYSEC-2023-83 Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web ser | 0.13.5 – < 0.27.0 | Undetermined |
| PYSEC-2026-161 BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks | < 1.0.1 | Undetermined |
| PYSEC-2026-1941 Starlette has possible denial-of-service vector when parsing large files in multipart forms | < 0.47.2 | Undetermined |
| PYSEC-2026-1942 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` | 0.39.0 – < 0.49.1 | Undetermined |
| PYSEC-2026-1943 Starlette Denial of service (DoS) via multipart/form-data | < 0.40.0 | Undetermined |
| PYSEC-2026-2280 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the | < 1.1.0 | Undetermined |
| PYSEC-2026-2281 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.c | < 1.1.0 | Undetermined |
| PYSEC-2026-248 Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because | < 1.3.0 | Undetermined |
| PYSEC-2026-249 Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption whi | 0.4.1 – < 1.3.1 | Undetermined |
Withdrawn advisories (3)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-3qj8-93xh-pwh2 Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files · withdrawn
- GHSA-93gm-qmq6-w238 Duplicate Advisory: Starlette Content-Type Header ReDoS · withdrawn
- GHSA-qj8w-rv5x-2v9h Duplicate Advisory: Starlette vulnerable to directory traversal · withdrawn
Sources
| Source | Licence |
|---|