starlette 0.3.6 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the starlette package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Regular Expression Denial of Service (ReDoS) starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `FileResponse._parse_range_header` method. An attacker can exhaust server CPU resources by sending a specially crafted HTTP Range header containing numerous small, non-overlapping ranges, which triggers quadratic-time processing during range parsing and merging. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `starlette` to version 0.49.1 or higher.	[,0.49.1)
M Allocation of Resources Without Limits or Throttling starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `UploadFile.write` method when handling multipart forms containing files larger than the default `spool_max_size`. An attacker can cause the application to block the main event thread by submitting a multipart form with a large file, preventing the application from accepting new connections. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `starlette` to version 0.47.2 or higher.	[,0.47.2)
H Allocation of Resources Without Limits or Throttling starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via `multipart/form-data` requests, due to treating parts without a `filename` as text form fields and buffering those in byte strings with no size limit. An attacker could cause `Starlette` to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt by uploading arbitrary large form fields. Note: This vulnerability affects all applications built with `Starlette` (or `FastAPI`) accepting form requests. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `starlette` to version 0.40.0 or higher.	[,0.40.0)
M Denial of Service (DoS) starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Denial of Service (DoS) via the `MultipartParser` class, which accepts an unlimited number of fields and files when parsing `multipart/form-data`. Exploiting this vulnerability is possible by sending too many small form fields with no content or too many empty files, which results in high CPU usage and high memory usage. Note: An affected application has to have all the following: `python-multipart` installed. calls `request.form()`. How to fix Denial of Service (DoS)? Upgrade `starlette` to version 0.25.0 or higher.	[,0.25.0)
H Directory Traversal starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Directory Traversal. Any file on the host machine can be read by passing an absolute path, formatted in a URL such as `http://localhost:5000/staticmount/c%3a%5cwindows%5cwin.ini`. How to fix Directory Traversal? Upgrade `starlette` to version 0.13.5 or higher.	[0,0.13.5)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the FileResponse._parse_range_header method. An attacker can exhaust server CPU resources by sending a specially crafted HTTP Range header containing numerous small, non-overlapping ranges, which triggers quadratic-time processing during range parsing and merging.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade starlette to version 0.49.1 or higher.

[,0.49.1)

Allocation of Resources Without Limits or Throttling

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the UploadFile.write method when handling multipart forms containing files larger than the default spool_max_size. An attacker can cause the application to block the main event thread by submitting a multipart form with a large file, preventing the application from accepting new connections.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade starlette to version 0.47.2 or higher.

[,0.47.2)

Allocation of Resources Without Limits or Throttling

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart/form-data requests, due to treating parts without a filename as text form fields and buffering those in byte strings with no size limit.

An attacker could cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt by uploading arbitrary large form fields.

Note:

This vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade starlette to version 0.40.0 or higher.

[,0.40.0)

Denial of Service (DoS)

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the MultipartParser class, which accepts an unlimited number of fields and files when parsing multipart/form-data. Exploiting this vulnerability is possible by sending too many small form fields with no content or too many empty files, which results in high CPU usage and high memory usage.

Note:

An affected application has to have all the following:

python-multipart installed.
calls request.form().

How to fix Denial of Service (DoS)?

Upgrade starlette to version 0.25.0 or higher.

[,0.25.0)

Directory Traversal

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Directory Traversal. Any file on the host machine can be read by passing an absolute path, formatted in a URL such as http://localhost:5000/staticmount/c%3a%5cwindows%5cwin.ini.

How to fix Directory Traversal?

Upgrade starlette to version 0.13.5 or higher.

[0,0.13.5)

starlette@0.3.6 vulnerabilities

The little ASGI library that shines.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically