{"url":"http://public2.vulnerablecode.io/api/packages/33361?format=json","purl":"pkg:pypi/starlette@0.8.1","type":"pypi","namespace":"","name":"starlette","version":"0.8.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"1.0.1","latest_non_vulnerable_version":"1.0.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37347?format=json","vulnerability_id":"VCID-2c5q-buqw-u7ex","summary":"BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks\nStarlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-48710.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-48710.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48710","reference_id":"","reference_type":"","scores":[{"value":"0.00353","scoring_system":"epss","scoring_elements":"0.57973","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48710"},{"reference_url":"https://badhost.org","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/"}],"url":"https://badhost.org"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48710","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48710"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/Kludex/starlette","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/Kludex/starlette"},{"reference_url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/"}],"url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"reference_url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/"}],"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/"}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"},{"reference_url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/"}],"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"reference_url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/","reference_id":"","reference_type":"","scores":[],"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/"},{"reference_url":"https://www.secwest.net/starlette","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/"}],"url":"https://www.secwest.net/starlette"},{"reference_url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-27T14:22:19Z/"}],"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"reference_url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/","reference_id":"","reference_type":"","scores":[],"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1137375","reference_id":"1137375","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1137375"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742","reference_id":"2481742","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"reference_url":"https://github.com/advisories/GHSA-86qp-5c8j-p5mr","reference_id":"GHSA-86qp-5c8j-p5mr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-86qp-5c8j-p5mr"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:22992","reference_id":"RHSA-2026:22992","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:22992"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:22993","reference_id":"RHSA-2026:22993","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:22993"},{"reference_url":"https://access.redhat.com/errata/RHSA-2026:23346","reference_id":"RHSA-2026:23346","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2026:23346"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50835?format=json","purl":"pkg:pypi/starlette@1.0.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@1.0.1"}],"aliases":["CVE-2026-48710","GHSA-86qp-5c8j-p5mr","PYSEC-2026-161","X41-2026-002"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2c5q-buqw-u7ex"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/56024?format=json","vulnerability_id":"VCID-71x5-qbjg-ukfq","summary":"Starlette Denial of service (DoS) via multipart/form-data\nStarlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47874.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-47874.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47874","reference_id":"","reference_type":"","scores":[{"value":"0.00125","scoring_system":"epss","scoring_elements":"0.31288","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-47874"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47874","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47874"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/encode/starlette","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette"},{"reference_url":"https://github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-15T16:23:43Z/"}],"url":"https://github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085295","reference_id":"1085295","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1085295"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318801","reference_id":"2318801","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318801"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47874","reference_id":"CVE-2024-47874","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47874"},{"reference_url":"https://github.com/advisories/GHSA-f96h-pmfr-66vw","reference_id":"GHSA-f96h-pmfr-66vw","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-f96h-pmfr-66vw"},{"reference_url":"https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw","reference_id":"GHSA-f96h-pmfr-66vw","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-15T16:23:43Z/"}],"url":"https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50805?format=json","purl":"pkg:pypi/starlette@0.40.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2c5q-buqw-u7ex"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.40.0"}],"aliases":["CVE-2024-47874","GHSA-f96h-pmfr-66vw"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-71x5-qbjg-ukfq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/36427?format=json","vulnerability_id":"VCID-8crr-rfdt-p7bq","summary":"There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30798","reference_id":"","reference_type":"","scores":[{"value":"0.0196","scoring_system":"epss","scoring_elements":"0.83852","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30798"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30798","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30798"},{"reference_url":"https://github.com/encode/starlette","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette"},{"reference_url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T20:30:33Z/"}],"url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa"},{"reference_url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T20:30:33Z/"}],"url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-48.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2023-48.yaml"},{"reference_url":"https://vulncheck.com/advisories/starlette-multipartparser-dos","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T20:30:33Z/"}],"url":"https://vulncheck.com/advisories/starlette-multipartparser-dos"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30798","reference_id":"CVE-2023-30798","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"8.7","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30798"},{"reference_url":"https://github.com/advisories/GHSA-74m5-2c7w-9w3x","reference_id":"GHSA-74m5-2c7w-9w3x","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-74m5-2c7w-9w3x"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33440?format=json","purl":"pkg:pypi/starlette@0.25.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2c5q-buqw-u7ex"},{"vulnerability":"VCID-71x5-qbjg-ukfq"},{"vulnerability":"VCID-gb68-ds24-f7h9"},{"vulnerability":"VCID-vgxy-kjyx-bqfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.25.0"}],"aliases":["CVE-2023-30798","GHSA-74m5-2c7w-9w3x","GMS-2023-353","PYSEC-2023-48"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8crr-rfdt-p7bq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46953?format=json","vulnerability_id":"VCID-gb68-ds24-f7h9","summary":"Starlette Content-Type Header ReDoS\n### Summary\n\nWhen using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options.\n\nAn attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. You'll see the server locks up, is unable to serve anymore requests and one CPU core is pegged to 100%\n\nYou can even start uvicorn with multiple workers with the --workers 4 argument and as long as you send (workers + 1) requests you'll completely DoS the FastApi server.\n\nIf you try submitting Json to the /submit_json endpoint with the malicious Content-Type header you'll see it isn't vulnerable. So this only affects FastAPI when it parses Form data.","references":[{"reference_url":"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74"},{"reference_url":"https://github.com/encode/starlette","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette"},{"reference_url":"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5"},{"reference_url":"https://github.com/advisories/GHSA-93gm-qmq6-w238","reference_id":"GHSA-93gm-qmq6-w238","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-93gm-qmq6-w238"},{"reference_url":"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238","reference_id":"GHSA-93gm-qmq6-w238","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50790?format=json","purl":"pkg:pypi/starlette@0.36.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2c5q-buqw-u7ex"},{"vulnerability":"VCID-71x5-qbjg-ukfq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.36.2"}],"aliases":["GHSA-93gm-qmq6-w238","GMS-2024-92"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gb68-ds24-f7h9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45015?format=json","vulnerability_id":"VCID-z5sa-2796-bbef","summary":"Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files\n## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-74m5-2c7w-9w3x. This link is maintained to preserve external references.\n\n## Original Description\nThere MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.","references":[{"reference_url":"https://github.com/encode/starlette","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette"},{"reference_url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa"},{"reference_url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x"},{"reference_url":"https://vulncheck.com/advisories/starlette-multipartparser-dos","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://vulncheck.com/advisories/starlette-multipartparser-dos"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30798","reference_id":"CVE-2023-30798","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30798"},{"reference_url":"https://github.com/advisories/GHSA-3qj8-93xh-pwh2","reference_id":"GHSA-3qj8-93xh-pwh2","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3qj8-93xh-pwh2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33440?format=json","purl":"pkg:pypi/starlette@0.25.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2c5q-buqw-u7ex"},{"vulnerability":"VCID-71x5-qbjg-ukfq"},{"vulnerability":"VCID-gb68-ds24-f7h9"},{"vulnerability":"VCID-vgxy-kjyx-bqfm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.25.0"}],"aliases":["GHSA-3qj8-93xh-pwh2"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z5sa-2796-bbef"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/starlette@0.8.1"}