starlette

PyPI5 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting starlettepage 1 of 1

CVE-2023-29159HIGHCVSS 7.5EG 7.5✓ Fixed in 0.27.0
2023-06-01
vulnerable: 0.13.5 ... 0.26.1 (28 versions)
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
CVE-2023-30798HIGHCVSS 7.5EG 7.5✓ Fixed in 0.25.0
2023-04-21
vulnerable: 0.1.0 ... 0.9.9 (128 versions)
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denia…
CVE-2024-47874HIGHCVSS 8.7EG 0.0✓ Fixed in 0.40.0
2024-10-15
vulnerable: 0.1.0 ... 0.9.9 (161 versions)
Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size l…
CVE-2025-54121MEDIUMCVSS 5.3EG 5.3✓ Fixed in 0.47.2
2025-07-21
vulnerable: 0.1.0 ... 0.9.9 (178 versions)
Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the …
CVE-2025-62727HIGHCVSS 7.5EG 7.5✓ Fixed in 0.49.1
2025-10-28
vulnerable: 0.39.0 ... 0.49.0 (24 versions)
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileRespons…

Check whether starlette is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for starlette CVEs against the assets you own.

Start Free Scan →