starlette has 6 CVEs on record between 2023 and 2026. The median CVSS is 5.3 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 0 prev 2
Worst active — by depth score
CVE-2025-62727High· 7.5Starlette is a lightweight ASGI framework/toolkit53CVE-2023-30798High· 7.5MultipartParser denial of service with too many fields or files42CVE-2026-48817Medium· 5.3Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`29CVE-2025-54121Medium· 5.3Starlette has possible denial-of-service vector when parsing large files in multipart forms29CVE-2023-29159Low· 3.7Starlette has Path Traversal vulnerability in StaticFiles21
starlette vulnerabilities
CVEs affecting starlette, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-48817Medium· 5.3Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
CVE-2026-54282Low· 3.7Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
CVE-2025-62727High· 7.5PoCStarlette is a lightweight ASGI framework/toolkit
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileRespo…
CVE-2025-54121Medium· 5.3Starlette has possible denial-of-service vector when parsing large files in multipart forms
Starlette has possible denial-of-service vector when parsing large files in multipart forms
CVE-2023-29159Low· 3.7Starlette has Path Traversal vulnerability in StaticFiles
Starlette has Path Traversal vulnerability in StaticFiles
CVE-2023-30798High· 7.5MultipartParser denial of service with too many fields or files
MultipartParser denial of service with too many fields or files