starlette@0.3.6 vulnerabilities

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart/form-data requests, due to treating parts without a filename as text form fields and buffering those in byte strings with no size limit.

An attacker could cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt by uploading arbitrary large form fields.

Note:

This vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.

Upgrade starlette to version 0.40.0 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the MultipartParser class, which accepts an unlimited number of fields and files when parsing multipart/form-data. Exploiting this vulnerability is possible by sending too many small form fields with no content or too many empty files, which results in high CPU usage and high memory usage.

Note:

An affected application has to have all the following:

1. python-multipart installed.

2. calls request.form().

Upgrade starlette to version 0.25.0 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Directory Traversal. Any file on the host machine can be read by passing an absolute path, formatted in a URL such as http://localhost:5000/staticmount/c%3a%5cwindows%5cwin.ini.

Upgrade starlette to version 0.13.5 or higher.