Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/starlette@0.20.3
Typepypi
Namespace
Namestarlette
Version0.20.3
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.0.1
Latest_non_vulnerable_version1.0.1
Affected_by_vulnerabilities
0
url VCID-2c5q-buqw-u7ex
vulnerability_id VCID-2c5q-buqw-u7ex
summary 
BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks
Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-48710.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-48710.json
1
reference_url https://badhost.org
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/
url https://badhost.org
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/Kludex/starlette
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/Kludex/starlette
4
reference_url https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/
url https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
5
reference_url https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/
url https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
6
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/
url https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-48710
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-48710
8
reference_url https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/
url https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
9
reference_url https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
reference_id
reference_type
scores
url https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
10
reference_url https://www.secwest.net/starlette
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/
url https://www.secwest.net/starlette
11
reference_url https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/
url https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
12
reference_url https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/
reference_id
reference_type
scores
url https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/
13
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1137375
reference_id 1137375
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1137375
14
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2481742
reference_id 2481742
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2481742
15
reference_url https://access.redhat.com/errata/RHSA-2026:22992
reference_id RHSA-2026:22992
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:22992
16
reference_url https://access.redhat.com/errata/RHSA-2026:22993
reference_id RHSA-2026:22993
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:22993
17
reference_url https://access.redhat.com/errata/RHSA-2026:23346
reference_id RHSA-2026:23346
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:23346
fixed_packages
0
url pkg:pypi/starlette@1.0.1
purl pkg:pypi/starlette@1.0.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@1.0.1
aliases CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2c5q-buqw-u7ex
1
url VCID-8crr-rfdt-p7bq
vulnerability_id VCID-8crr-rfdt-p7bq
summary There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
references
0
reference_url https://github.com/encode/starlette
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/encode/starlette
1
reference_url https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T20:30:33Z/
url https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa
2
reference_url https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T20:30:33Z/
url https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x
3
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-48.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-48.yaml
4
reference_url https://vulncheck.com/advisories/starlette-multipartparser-dos
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T20:30:33Z/
url https://vulncheck.com/advisories/starlette-multipartparser-dos
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30798
reference_id CVE-2023-30798
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30798
6
reference_url https://github.com/advisories/GHSA-74m5-2c7w-9w3x
reference_id GHSA-74m5-2c7w-9w3x
reference_type
scores
url https://github.com/advisories/GHSA-74m5-2c7w-9w3x
fixed_packages
0
url pkg:pypi/starlette@0.25.0
purl pkg:pypi/starlette@0.25.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2c5q-buqw-u7ex
1
vulnerability VCID-vgxy-kjyx-bqfm
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.25.0
aliases CVE-2023-30798, GHSA-74m5-2c7w-9w3x, GMS-2023-353, PYSEC-2023-48
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8crr-rfdt-p7bq
2
url VCID-vgxy-kjyx-bqfm
vulnerability_id VCID-vgxy-kjyx-bqfm
summary Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
references
0
reference_url https://github.com/encode/starlette
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/encode/starlette
1
reference_url https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174
2
reference_url https://github.com/encode/starlette/commit/1797de464124b090f10cf570441e8292936d63e3
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/encode/starlette/commit/1797de464124b090f10cf570441e8292936d63e3
3
reference_url https://github.com/encode/starlette/releases/tag/0.27.0
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-01-09T19:18:22Z/
url https://github.com/encode/starlette/releases/tag/0.27.0
4
reference_url https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-01-09T19:18:22Z/
url https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-83.yaml
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-83.yaml
6
reference_url https://jvn.jp/en/jp/JVN95981715
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://jvn.jp/en/jp/JVN95981715
7
reference_url https://jvn.jp/en/jp/JVN95981715/
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-01-09T19:18:22Z/
url https://jvn.jp/en/jp/JVN95981715/
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-29159
reference_id CVE-2023-29159
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-29159
9
reference_url https://github.com/advisories/GHSA-v5gw-mw7f-84px
reference_id GHSA-v5gw-mw7f-84px
reference_type
scores
url https://github.com/advisories/GHSA-v5gw-mw7f-84px
fixed_packages
0
url pkg:pypi/starlette@0.27.0
purl pkg:pypi/starlette@0.27.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2c5q-buqw-u7ex
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.27.0
aliases CVE-2023-29159, GHSA-v5gw-mw7f-84px, GMS-2023-1556, PYSEC-2023-83
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vgxy-kjyx-bqfm
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.20.3