CVE catalog

CVE-2025-54121

starlette affected and fixed versions

Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jul 21, 2025, 7:34:23 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.66% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "starlette",
      "status": "fixed",
      "release": "sid",
      "version": "1.9.0-1"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "forky",
      "version": "1.9.0-1"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "trixie",
      "version": "0.46.1-3+deb13u3"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "trixie-security",
      "version": "0.46.1-3+deb13u3"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "bookworm",
      "version": "0.26.1-1+deb12u1"
    },
    {
      "name": "starlette",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "0.26.1-1+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1109805,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "0.46.1-3"
    },
    {
      "bug": 1109805,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "0.46.1-3"
    },
    {
      "bug": 1109805,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "0.46.1-3"
    },
    {
      "bug": 1109805,
      "name": "starlette",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "0.26.1-1+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "starlette",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.47.2"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "0.47.2",
      "provider_record_id": "GHSA-2C2J-9GV5-CJ73"
    },
    {
      "name": "starlette",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.47.2"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "0.47.2",
      "provider_record_id": "PYSEC-2026-1941"
    },
    {
      "name": "python-starlette",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.41.3-160000.3.1"
            }
          ]
        }
      ],
      "release": "leap 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.41.3-160000.3.1",
      "provider_record_id": "OPENSUSE-SU-2026:20975-1"
    },
    {
      "name": "python-starlette",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.41.3-160000.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.41.3-160000.3.1",
      "provider_record_id": "SUSE-SU-2026:22151-1"
    },
    {
      "name": "python-starlette",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.41.3-160000.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.41.3-160000.3.1",
      "provider_record_id": "SUSE-SU-2026:22151-1"
    },
    {
      "name": "python-starlette",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.35.1-150600.3.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.35.1-150600.3.6.1",
      "provider_record_id": "SUSE-SU-2025:02544-1"
    },
    {
      "name": "python-starlette",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.47.2-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.47.2-1.1",
      "provider_record_id": "OPENSUSE-SU-2025:15381-1"
    }
  ]
}

[Debian bug #1109805]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[python3-starlette]Unknown
Source package: [starlette]
Details (4)
- 0.26.1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12
- 0.26.1-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12
- 0.26.1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12
- 0.26.1-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 0.26.1-1+deb12u1
  dsa · starlette · debian · bookworm; dsa · starlette · debian · 12

[Debian 13 (Trixie)]

[python3-starlette]Unknown
Source package: [starlette]
Details (5)
- 0.46.1-3+deb13u2 · all · trixie
  Fixed · Fixed: 0.46.1-3
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u2 · all · trixie
  Fixed · Fixed: 0.46.1-3
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 0.46.1-3
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u3 · all · trixie-security
  Fixed · Fixed: 0.46.1-3
  dsa · starlette · debian · 13
- 0.46.1-3+deb13u3 · all · trixie-security
  Fixed · Fixed: 0.46.1-3
  dsa · starlette · debian · 13

[openSUSE Tumbleweed]

[python313-starlette]Unknown
Source package: [python-starlette]
Details (1)
- 1.6.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 0.47.2-1.1
  Version impact unknown
  dsa · python-starlette · opensuse · tumbleweed
[python314-starlette]Unknown
Source package: [python-starlette]
Details (1)
- 1.6.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 0.47.2-1.1
  Version impact unknown
  dsa · python-starlette · opensuse · tumbleweed

Observed: Oct 27, 2026, 12:54:20 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]