- Latest release
- 1.10.0 (Oct 24, 2026): no advisory affects it
- Newest unaffected release
- 1.10.0 (Oct 24, 2026), the latest release
- Advisories
- 10 · 6 high, 3 medium, 1 low
- Weekly downloads
- 159.6M
- Dependents
- 55.3K
- Releases
- 206 since 0.1.0 (Jun 25, 2018)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-54283Affects 0.4.1 to 1.3.0 (1.3.1 is outside it)
- CVE-2026-54282Affects 0.1.0 to 1.2.1 (1.3.0 is outside it)
- CVE-2026-48817Affects 0.1.0 to 1.0.1 (1.1.0 is outside it)
- CVE-2026-48818Affects 0.1.0 to 1.0.1 (1.1.0 is outside it)
- CVE-2026-48710Affects 0.1.0 to 1.0.0 (1.0.1 is outside it)
- CVE-2025-62727Affects 0.39.0 to 0.49.0 (0.49.1 is outside it)
- CVE-2025-54121Affects 0.1.0 to 0.47.1 (0.47.2 is outside it)
- CVE-2024-47874Affects 0.1.0 to 0.39.2 (0.40.0 is outside it)
- CVE-2023-29159Affects 0.13.5 to 0.26.1 (0.27.0 is outside it)
- CVE-2023-30798Affects 0.1.0 to 0.24.0 (0.25.0 is outside it)
Advisories 10
- CVE-2026-54283High 7.5
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Affected: from 0.4.1, fixed in 1.3.1.
Fixed in 1.3.1 (released Jun 12, 2026, 10 days before disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2026-54282Low 3.7
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Affected: fixed in 1.3.0.
Fixed in 1.3.0 (released Jun 11, 2026, 11 days before disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2026-48817Medium 5.3
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released May 23, 2026, 25 days before disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2026-48818High 7.5
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released May 23, 2026, 25 days before disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2026-48710Medium 6.5 · KEV
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Affected: fixed in 1.0.1.
Fixed in 1.0.1 (released May 21, 2026, 5 days before disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2025-62727High 7.5
Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse
Affected: from 0.39.0, fixed in 0.49.1.
Fixed in 0.49.1 (released Oct 28, 2025, the day of disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2025-54121Medium 5.3
Starlette has possible denial-of-service vector when parsing large files in multipart forms
Affected: fixed in 0.47.2.
Fixed in 0.47.2 (released Jul 20, 2025, 1 day before disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2024-47874High 8.7
Starlette Denial of service (DoS) via multipart/form-data
Affected: fixed in 0.40.0.
Fixed in 0.40.0 (released Oct 15, 2024, the day of disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2023-29159High 7.5
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to…
Affected: from 0.13.5, fixed in 0.27.0.
Fixed in 0.27.0 (released May 16, 2023, 16 days before disclosure).
The latest release, 1.10.0, is not affected.
- CVE-2023-30798High 7.5
MultipartParser DOS with too many fields or files in Starlette Framework
Affected: fixed in 0.25.0; fixed in 0.25.0.
Fixed in 0.25.0 (released Feb 14, 2023, 66 days before disclosure).
The latest release, 1.10.0, is not affected.