Vulnerability · Published Jul 21, 2025 · Assigned by GitHub_M
CVE-2025-54121Starlette has possible denial-of-service vector when parsing large files in multipart forms
Medium 5.3
In plain English
A medium-severity resource allocation without limits in starlette from encode. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | starlette | 0.26.1-1+deb12u1 | DEBIAN-CVE-2025-54121 |
| Debian:13 | starlette | 0.46.1-3 | DEBIAN-CVE-2025-54121 |
| Debian:14 | starlette | 0.46.1-3 | DEBIAN-CVE-2025-54121 |
| PyPI | starlette | 0.47.2 | GHSA-2c2j-9gv5-cj73 |
| PyPI | starlette | 0.47.2 | PYSEC-2026-1941 |
| Ubuntu:22.04:LTS | starlette | no fix listed | UBUNTU-CVE-2025-54121 |
| Ubuntu:24.04:LTS | starlette | no fix listed | UBUNTU-CVE-2025-54121 |
| Ubuntu:25.10 | starlette | no fix listed | UBUNTU-CVE-2025-54121 |
| Ubuntu:26.04:LTS | starlette | no fix listed | UBUNTU-CVE-2025-54121 |
| Ubuntu:26.10 | starlette | no fix listed | UBUNTU-CVE-2025-54121 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73 x_refsource_CONFIRM
- https://github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1 x_refsource_MISC
- https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14 x_refsource_MISC
- https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403 x_refsource_MISC