Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/starlette@0.49.1
Typepypi
Namespace
Namestarlette
Version0.49.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.0.1
Latest_non_vulnerable_version1.0.1
Affected_by_vulnerabilities
0
url VCID-2c5q-buqw-u7ex
vulnerability_id VCID-2c5q-buqw-u7ex
summary 
BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks
Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path.
references
0
reference_url https://badhost.org
reference_id
reference_type
scores
url https://badhost.org
1
reference_url https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
reference_id
reference_type
scores
url https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
2
reference_url https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
reference_id
reference_type
scores
url https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
3
reference_url https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
reference_id
reference_type
scores
url https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
4
reference_url https://www.secwest.net/starlette
reference_id
reference_type
scores
url https://www.secwest.net/starlette
5
reference_url https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/
reference_id
reference_type
scores
url https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/
fixed_packages
0
url pkg:pypi/starlette@1.0.1
purl pkg:pypi/starlette@1.0.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@1.0.1
aliases CVE-2026-48710, GHSA-86qp-5c8j-p5mr, PYSEC-2026-161, X41-2026-002
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2c5q-buqw-u7ex
Fixing_vulnerabilities
0
url VCID-6wzh-4g3t-93gv
vulnerability_id VCID-6wzh-4g3t-93gv
summary 
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).
references
0
reference_url https://github.com/Kludex/starlette
reference_id
reference_type
scores
url https://github.com/Kludex/starlette
1
reference_url https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5
reference_id
reference_type
scores
url https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5
2
reference_url https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c
reference_id
reference_type
scores
url https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c
3
reference_url https://github.com/Kludex/starlette/releases/tag/0.49.1
reference_id
reference_type
scores
url https://github.com/Kludex/starlette/releases/tag/0.49.1
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-62727
reference_id CVE-2025-62727
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2025-62727
5
reference_url https://github.com/advisories/GHSA-7f5h-v6xp-fcq8
reference_id GHSA-7f5h-v6xp-fcq8
reference_type
scores
url https://github.com/advisories/GHSA-7f5h-v6xp-fcq8
6
reference_url https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8
reference_id GHSA-7f5h-v6xp-fcq8
reference_type
scores
url https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8
fixed_packages
0
url pkg:pypi/starlette@0.49.1
purl pkg:pypi/starlette@0.49.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2c5q-buqw-u7ex
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.49.1
aliases CVE-2025-62727, GHSA-7f5h-v6xp-fcq8
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6wzh-4g3t-93gv
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.49.1