Kludex starlette
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-54283 | >= 0.4.1, < 1.3.1 | Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS | HIGH 7.5 | 0.5 % | ||
| CVE-2026-54282 | < 1.3.0 | Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-48817 | < 1.1.0 | Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-48818 | < 1.1.0 | Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows | HIGH 7.5 | 0.4 % | ||
| CVE-2026-48710 | < 1.0.1 | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks | MEDIUM 6.5 | 70 % | KEV | |
| CVE-2025-62727 | >= 0.39.0, < 0.49.1 | Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse | HIGH 7.5 | 0.8 % |