starlette 0.40.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the starlette package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Regular Expression Denial of Service (ReDoS) starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `FileResponse._parse_range_header` method. An attacker can exhaust server CPU resources by sending a specially crafted HTTP Range header containing numerous small, non-overlapping ranges, which triggers quadratic-time processing during range parsing and merging. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `starlette` to version 0.49.1 or higher.	[,0.49.1)
M Allocation of Resources Without Limits or Throttling starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `UploadFile.write` method when handling multipart forms containing files larger than the default `spool_max_size`. An attacker can cause the application to block the main event thread by submitting a multipart form with a large file, preventing the application from accepting new connections. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `starlette` to version 0.47.2 or higher.	[,0.47.2)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the FileResponse._parse_range_header method. An attacker can exhaust server CPU resources by sending a specially crafted HTTP Range header containing numerous small, non-overlapping ranges, which triggers quadratic-time processing during range parsing and merging.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade starlette to version 0.49.1 or higher.

[,0.49.1)

Allocation of Resources Without Limits or Throttling

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the UploadFile.write method when handling multipart forms containing files larger than the default spool_max_size. An attacker can cause the application to block the main event thread by submitting a multipart form with a large file, preventing the application from accepting new connections.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade starlette to version 0.47.2 or higher.

[,0.47.2)

starlette@0.40.0 vulnerabilities

The little ASGI library that shines.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically