Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via `multipart/form-data` requests, due to treating parts without a `filename` as text form fields and buffering those in byte strings with no size limit. An attacker could cause `Starlette` to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt by uploading arbitrary large form fields. Note: This vulnerability affects all applications built with `Starlette` (or `FastAPI`) accepting form requests. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `starlette` to version 0.40.0 or higher.	[,0.40.0)
M Denial of Service (DoS) starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Denial of Service (DoS) via the `MultipartParser` class, which accepts an unlimited number of fields and files when parsing `multipart/form-data`. Exploiting this vulnerability is possible by sending too many small form fields with no content or too many empty files, which results in high CPU usage and high memory usage. Note: An affected application has to have all the following: `python-multipart` installed. calls `request.form()`. How to fix Denial of Service (DoS)? Upgrade `starlette` to version 0.25.0 or higher.	[,0.25.0)
H Directory Traversal starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Directory Traversal. Any file on the host machine can be read by passing an absolute path, formatted in a URL such as `http://localhost:5000/staticmount/c%3a%5cwindows%5cwin.ini`. How to fix Directory Traversal? Upgrade `starlette` to version 0.13.5 or higher.	[0,0.13.5)

Go back to all versions of this package