7.5

GHSA-3QJ8-93XH-PWH2: starlette PyPI

CVSS: 7.5v3.1HighPublished
Published 21-04-2023Last modified 28-11-2024
Open JSON

Vulnerability summary

GHSA-3QJ8-93XH-PWH2 is a high (CVSS 7.5) vulnerability in starlette PyPI.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (OSV · Pypi), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 21-04-2023
    PublishedVulnerability first disclosed.
  2. 28-11-2024
    Last modifiedVulnerability information updated.

Description

Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-74m5-2c7w-9w3x. This link is maintained to preserve external references. ## Original Description There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

PyPI1 product
  • starlette< 0.25.0

1 vendor · 1 product

References

5 links