CVE catalog

CVE-2024-47874

starlette affected and fixed versions

Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette. This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests. Verison 0.40.0 fixes this issue.

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 15, 2024, 3:45:03 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.65% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "starlette",
      "status": "fixed",
      "release": "sid",
      "version": "1.9.0-1"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "forky",
      "version": "1.9.0-1"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "trixie",
      "version": "0.46.1-3+deb13u3"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "trixie-security",
      "version": "0.46.1-3+deb13u3"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "bookworm",
      "version": "0.26.1-1+deb12u1"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "0.26.1-1+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1085295,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "0.41.0-1"
    },
    {
      "bug": 1085295,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "0.41.0-1"
    },
    {
      "bug": 1085295,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "0.41.0-1"
    },
    {
      "bug": 1085295,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "0.26.1-1+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "starlette",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.40.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "0.40.0",
      "provider_record_id": "GHSA-F96H-PMFR-66VW"
    },
    {
      "name": "starlette",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.40.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "0.40.0",
      "provider_record_id": "PYSEC-2026-1943"
    },
    {
      "name": "python-starlette",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.6.0-1.1",
      "provider_record_id": "OPENSUSE-SU-2026:11626-1"
    },
    {
      "name": "python-starlette",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.35.1-150600.3.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.35.1-150600.3.3.1",
      "provider_record_id": "SUSE-SU-2024:3719-1"
    },
    {
      "name": "python-starlette",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.41.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.41.0-1.1",
      "provider_record_id": "OPENSUSE-SU-2024:14417-1"
    },
    {
      "name": "starlette",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "0.14.1-1",
        "0.16.0-1",
        "0.18.0-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2024-47874"
    },
    {
      "name": "starlette",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "0.30.0-1",
        "0.31.1-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2024-47874"
    }
  ]
}

[Debian bug #1085295]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[python3-starlette]Unknown
Source package: [starlette]
Details (4)
- 0.26.1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12
- 0.26.1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12
- 0.26.1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12
- 0.26.1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12

[Debian 13 (Trixie)]

[python3-starlette]Unknown
Source package: [starlette]
Details (5)
- 0.46.1-3+deb13u2 · all · trixie
  Fixed · Fixed: 0.41.0-1
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u2 · all · trixie
  Fixed · Fixed: 0.41.0-1
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 0.41.0-1
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u3 · all · trixie-security
  Fixed · Fixed: 0.41.0-1
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u3 · all · trixie-security
  Fixed · Fixed: 0.41.0-1
  dsa · starlette · debian · 13

[openSUSE Tumbleweed]

[python313-starlette]Unknown
Source package: [python-starlette]
Details (1)
- 1.6.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 0.41.0-1.1, 1.6.0-1.1
  Version impact unknown
  dsa · python-starlette · opensuse · tumbleweed
[python314-starlette]Unknown
Source package: [python-starlette]
Details (1)
- 1.6.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 0.41.0-1.1, 1.6.0-1.1
  Version impact unknown
  dsa · python-starlette · opensuse · tumbleweed

Observed: Oct 27, 2026, 6:58:39 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]