Homepage

starlette@0.25.0 vulnerabilities

The little ASGI library that shines.

  • latest version

    0.46.2

  • latest non vulnerable version

    0.46.2

  • first published

    6 years ago

  • latest version published

    8 days ago

  • licenses detected

  • View starlette package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the starlette package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Allocation of Resources Without Limits or Throttling

    starlette is a The little ASGI library that shines.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart/form-data requests, due to treating parts without a filename as text form fields and buffering those in byte strings with no size limit.

    An attacker could cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt by uploading arbitrary large form fields.

    Note:

    This vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade starlette to version 0.40.0 or higher.

    [,0.40.0)
    • H
    Directory Traversal

    starlette is a The little ASGI library that shines.

    Affected versions of this package are vulnerable to Directory Traversal when using the StaticFiles class. If there is a file or directory that starts with the same name as the StaticFiles directory that file or directory is also exposed via StaticFiles when os.path.commonprefix() returns the longest common prefix between two paths.

    Passing a path like /static/../static1.txt, os.path.commonprefix([full_path, directory]) returns ./static, which is the common part of ./static1.txt and ./static. It refers to /static/../static1.txt because it is considered in the staticfiles directory. As a result, it becomes possible to view files that should not be open to the public.

    How to fix Directory Traversal?

    Upgrade starlette to version 0.27.0 or higher.

    [0.13.5,0.27.0)
    Go back to all versions of this package