starlette (PyPI)
The little ASGI framework that shines. 🌟
Advisories
30
Latest version
1.10.0
Released Oct 24, 2026
License
BSD-3-Clause
OpenSSF Scorecard
—
How to fix
Upgrading to 1.3.1 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "starlette>=1.10.0"poetry
poetry add "starlette>=1.10.0"uv
uv add "starlette>=1.10.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-82w8-qh3p-5jfq Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS |
High EPSS 0.48% |
>= 0.4.1, < 1.3.1 | 1.3.1 |
| GHSA-82w8-qh3p-5jfq Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS |
High EPSS 0.48% |
>= 0.4.1, < 1.3.1 | 1.3.1 |
| GHSA-82w8-qh3p-5jfq Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS |
High EPSS 0.48% |
>= 0.4.1, < 1.3.1 | 1.3.1 |
| GHSA-jp82-jpqv-5vv3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname |
Medium EPSS 0.27% |
< 1.3.0 | 1.3.0 |
| GHSA-jp82-jpqv-5vv3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname |
Medium EPSS 0.27% |
< 1.3.0 | 1.3.0 |
| GHSA-jp82-jpqv-5vv3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname |
Medium EPSS 0.27% |
< 1.3.0 | 1.3.0 |
| GHSA-wqp7-x3pw-xc5r Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows |
High EPSS 0.37% |
< 1.1.0 | 1.1.0 |
| GHSA-wqp7-x3pw-xc5r Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows |
High EPSS 0.37% |
< 1.1.0 | 1.1.0 |
| GHSA-wqp7-x3pw-xc5r Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows |
High EPSS 0.37% |
< 1.1.0 | 1.1.0 |
| GHSA-x746-7m8f-x49c Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` |
Medium EPSS 0.21% |
< 1.1.0 | 1.1.0 |
| GHSA-x746-7m8f-x49c Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` |
Medium EPSS 0.21% |
< 1.1.0 | 1.1.0 |
| GHSA-x746-7m8f-x49c Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` |
Medium EPSS 0.21% |
< 1.1.0 | 1.1.0 |
| GHSA-86qp-5c8j-p5mr Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Known exploited |
Medium EPSS 70.29% |
< 1.0.1 | 1.0.1 |
| GHSA-86qp-5c8j-p5mr Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Known exploited |
Medium EPSS 70.29% |
< 1.0.1 | 1.0.1 |
| GHSA-86qp-5c8j-p5mr Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Known exploited |
Medium EPSS 70.29% |
<= 1.0.0 | No fix yet |
| GHSA-7f5h-v6xp-fcq8 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` |
High EPSS 0.80% |
>= 0.39.0, < 0.49.1 | 0.49.1 |
| GHSA-7f5h-v6xp-fcq8 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` |
High EPSS 0.80% |
>= 0.39.0, < 0.49.1 | 0.49.1 |
| GHSA-7f5h-v6xp-fcq8 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` |
High EPSS 0.80% |
>= 0.39.0, <= 0.49.0 | No fix yet |
| GHSA-2c2j-9gv5-cj73 Starlette has possible denial-of-service vector when parsing large files in multipart forms |
Medium EPSS 0.66% |
< 0.47.2 | 0.47.2 |
| GHSA-2c2j-9gv5-cj73 Starlette has possible denial-of-service vector when parsing large files in multipart forms |
Medium EPSS 0.66% |
< 0.47.2 | 0.47.2 |
| GHSA-2c2j-9gv5-cj73 Starlette has possible denial-of-service vector when parsing large files in multipart forms |
Medium EPSS 0.66% |
< 0.47.2 | 0.47.2 |
| GHSA-f96h-pmfr-66vw Starlette Denial of service (DoS) via multipart/form-data |
High EPSS 0.65% |
< 0.40.0 | 0.40.0 |
| GHSA-f96h-pmfr-66vw Starlette Denial of service (DoS) via multipart/form-data |
High EPSS 0.65% |
< 0.40.0 | 0.40.0 |
| GHSA-93gm-qmq6-w238 Duplicate Advisory: Starlette Content-Type Header ReDoS Withdrawn |
High EPSS 1.52% |
< 0.36.2 | 0.36.2 |
| GHSA-qj8w-rv5x-2v9h Duplicate Advisory: Starlette vulnerable to directory traversal Withdrawn |
High | >= 0.13.5, < 0.27.0 | 0.27.0 |
| GHSA-v5gw-mw7f-84px Starlette has Path Traversal vulnerability in StaticFiles |
High EPSS 2.05% |
>= 0.13.5, < 0.27.0 | 0.27.0 |
| GHSA-v5gw-mw7f-84px Starlette has Path Traversal vulnerability in StaticFiles |
High EPSS 2.05% |
>= 0.13.5, < 0.27.0 | 0.27.0 |
| GHSA-3qj8-93xh-pwh2 Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files Withdrawn |
High | < 0.25.0 | 0.25.0 |
| GHSA-74m5-2c7w-9w3x MultipartParser denial of service with too many fields or files |
High EPSS 1.30% |
< 0.25.0 | 0.25.0 |
| GHSA-74m5-2c7w-9w3x MultipartParser denial of service with too many fields or files |
High EPSS 1.30% |
< 0.25.0 | 0.25.0 |
Source: https://github.com/Kludex/starlette
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor