Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Affected range
ECOSYSTEM: introduced 0; fixed 1.0.1Fixed versions: 1.0.1
starlette
The little ASGI library that shines.
PyPI latest 1.6.0 BSD-3-Clause
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
1.6.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
10 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-82w8-qh3p-5jfq high
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Affected range
ECOSYSTEM: introduced 0.4.1; fixed 1.3.1Fixed versions: 1.3.1
GHSA-wqp7-x3pw-xc5r high
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Affected range
ECOSYSTEM: introduced 0; fixed 1.1.0Fixed versions: 1.1.0
GHSA-7f5h-v6xp-fcq8 high
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Affected range
ECOSYSTEM: introduced 0.39.0; fixed 0.49.1Fixed versions: 0.49.1
GHSA-f96h-pmfr-66vw high
Starlette Denial of service (DoS) via multipart/form-data
Affected range
ECOSYSTEM: introduced 0; fixed 0.40.0Fixed versions: 0.40.0
GHSA-74m5-2c7w-9w3x high
MultipartParser denial of service with too many fields or files
Affected range
ECOSYSTEM: introduced 0; fixed 0.25.0GIT: introduced 0; fixed 8c74c2c8dba7030154f8af18e016136bea1938faFixed versions: 0.25.0, 8c74c2c8dba7030154f8af18e016136bea1938fa
GHSA-jp82-jpqv-5vv3 moderate
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Affected range
ECOSYSTEM: introduced 0; fixed 1.3.0Fixed versions: 1.3.0
GHSA-2c2j-9gv5-cj73 moderate
Starlette has possible denial-of-service vector when parsing large files in multipart forms
Affected range
ECOSYSTEM: introduced 0; fixed 0.47.2Fixed versions: 0.47.2
GHSA-x746-7m8f-x49c moderate
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Affected range
ECOSYSTEM: introduced 0; fixed 1.1.0Fixed versions: 1.1.0
GHSA-v5gw-mw7f-84px moderate
Starlette has Path Traversal vulnerability in StaticFiles
Affected range
ECOSYSTEM: introduced 0.13.5; fixed 0.27.0Fixed versions: 0.27.0