CVE-2024-47874High· 7.5▾ TwilightA flaw was found in Starlette. Starlette treats multipart/form-data parts without a filename as text form fields and buffers those in byte strings with no size limit. This flaw allows an attacker to upload arbitrary large form fields and c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.7%
Last analysed / modified upstream
0 → 7.5
none → high
A flaw was found in Starlette. Starlette treats multipart/form-data parts without a filename as text form fields and buffers those in byte strings with no size limit. This flaw allows an attacker to upload arbitrary large form fields and cause Starlette to slow down significantly due to excessive memory allocations and copy operations also to consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an out-of-memory (OOM) error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette.
starlette: Starlette Denial of service (DoS) via multipart/form-data — rated Important by Red Hat. Released 2024-10-15, updated 2026-10-15.
Affected:
No fix planned:
Will not fix
Affected packages:
starlette < 0.40.0Patched in:
starlette 0.40.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-62426Medium· 6.5vllm: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` (CVE-2025-624…
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2025-48956High· 7.5vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests (CVE-2025-48956)
CVE-2025-6985High· 7.5langchain-text-splitters: XXE Vulnerability in langchain-text-splitters (CVE-2025-6985)
CVE-2025-53643Low· 3.7aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)
CVE-2025-65106High· 8.2langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates (CVE-2025-65106)