Skip to content
OpenAdvisories

Product · Kludex

starlette

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-54283

    Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

    Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for a…

    Kludex starlette airflow-3 kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-48818

    Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

    Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejec…

    Kludex starlette starlette starlette Ubuntu PyPI
  • High 7.5
    CVE-2025-62727 Public exploit

    Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

    Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…

    Kludex starlette open-webui airflow-3 Debian Ubuntu Wolfi PyPI