pypi

starlette

23 Total advisories

23 Vulnerabilities

0 Malware

Dependency scanning

Check whether starlette is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

starlette

Vulnerabilities

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Starlette has possible denial-of-service vector when parsing large files in multipart forms

Starlette Denial of service (DoS) via multipart/form-data

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

Duplicate Advisory: Starlette Content-Type Header ReDoS

CVE-2026-48817

CVE-2026-48818

Starlette has Path Traversal vulnerability in StaticFiles

MultipartParser denial of service with too many fields or files

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Starlette Denial of service (DoS) via multipart/form-data

Starlette has possible denial-of-service vector when parsing large files in multipart forms

CVE-2026-54283

CVE-2026-54282

BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks

Duplicate Advisory: Starlette vulnerable to directory traversal

Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files

CVE-2023-30798

CVE-2023-29159

Browse more PyPI advisories

Start Securing