# starlette (PyPI) vulnerabilities 10 known vulnerabilities (6 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.10.0 (Oct 24, 2026): no advisory affects it - Newest unaffected release: 1.10.0 (Oct 24, 2026), the latest release - Weekly downloads: 159.6M - Dependents: 55.3K - Releases: 206 since 0.1.0 (Jun 25, 2018) - Registry: https://pypi.org/project/starlette/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-54283: 0.4.1 to 1.3.0 (1.3.1 is outside it) - CVE-2026-54282: 0.1.0 to 1.2.1 (1.3.0 is outside it) - CVE-2026-48817: 0.1.0 to 1.0.1 (1.1.0 is outside it) - CVE-2026-48818: 0.1.0 to 1.0.1 (1.1.0 is outside it) - CVE-2026-48710: 0.1.0 to 1.0.0 (1.0.1 is outside it) - CVE-2025-62727: 0.39.0 to 0.49.0 (0.49.1 is outside it) - CVE-2025-54121: 0.1.0 to 0.47.1 (0.47.2 is outside it) - CVE-2024-47874: 0.1.0 to 0.39.2 (0.40.0 is outside it) - CVE-2023-29159: 0.13.5 to 0.26.1 (0.27.0 is outside it) - CVE-2023-30798: 0.1.0 to 0.24.0 (0.25.0 is outside it) ## Advisories (10) ### [CVE-2026-54283](https://cve.now/CVE-2026-54283): Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS - Severity: High 7.5 - Published: Jun 22, 2026 - Affected: from 0.4.1, fixed in 1.3.1. - Fixed in 1.3.1 (released Jun 12, 2026, 10 days before disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2026-54282](https://cve.now/CVE-2026-54282): Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname - Severity: Low 3.7 - Published: Jun 22, 2026 - Affected: fixed in 1.3.0. - Fixed in 1.3.0 (released Jun 11, 2026, 11 days before disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2026-48817](https://cve.now/CVE-2026-48817): Starlette: Arbitrary HTTP method dispatched to \`HTTPEndpoint\` attributes via \`getattr\` - Severity: Medium 5.3 - Published: Jun 17, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released May 23, 2026, 25 days before disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2026-48818](https://cve.now/CVE-2026-48818): Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows - Severity: High 7.5 - Published: Jun 17, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released May 23, 2026, 25 days before disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2026-48710](https://cve.now/CVE-2026-48710): Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks - Severity: Medium 6.5 · KEV - Published: May 26, 2026 - Affected: fixed in 1.0.1. - Fixed in 1.0.1 (released May 21, 2026, 5 days before disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2025-62727](https://cve.now/CVE-2025-62727): Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse - Severity: High 7.5 - Published: Oct 28, 2025 - Affected: from 0.39.0, fixed in 0.49.1. - Fixed in 0.49.1 (released Oct 28, 2025, the day of disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2025-54121](https://cve.now/CVE-2025-54121): Starlette has possible denial-of-service vector when parsing large files in multipart forms - Severity: Medium 5.3 - Published: Jul 21, 2025 - Affected: fixed in 0.47.2. - Fixed in 0.47.2 (released Jul 20, 2025, 1 day before disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2024-47874](https://cve.now/CVE-2024-47874): Starlette Denial of service (DoS) via multipart/form-data - Severity: High 8.7 - Published: Oct 15, 2024 - Affected: fixed in 0.40.0. - Fixed in 0.40.0 (released Oct 15, 2024, the day of disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2023-29159](https://cve.now/CVE-2023-29159): Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to… - Severity: High 7.5 - Published: Jun 1, 2023 - Affected: from 0.13.5, fixed in 0.27.0. - Fixed in 0.27.0 (released May 16, 2023, 16 days before disclosure). - The latest release, 1.10.0, is not affected. ### [CVE-2023-30798](https://cve.now/CVE-2023-30798): MultipartParser DOS with too many fields or files in Starlette Framework - Severity: High 7.5 - Published: Apr 21, 2023 - Affected: fixed in 0.25.0; fixed in 0.25.0. - Fixed in 0.25.0 (released Feb 14, 2023, 66 days before disclosure). - The latest release, 1.10.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/starlette Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.