Vulnerabilities for starlette

First version without a known vulnerability: 1.3.1

Details

• GHSA-82w8-qh3p-5jfq2026-06-15

  Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

  Fixed in: 1.3.1

• GHSA-jp82-jpqv-5vv32026-06-15

  Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

  Fixed in: 1.3.0

• GHSA-wqp7-x3pw-xc5r2026-06-15

  Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

  Fixed in: 1.1.0

• GHSA-x746-7m8f-x49c2026-06-15

  Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

  Fixed in: 1.1.0

• GHSA-86qp-5c8j-p5mr2026-06-04

  Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

  Fixed in: 1.0.1

• GHSA-7f5h-v6xp-fcq82025-10-28

  Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

  Fixed in: 0.49.1

• GHSA-2c2j-9gv5-cj732025-07-21

  Starlette has possible denial-of-service vector when parsing large files in multipart forms

  Fixed in: 0.47.2

• GHSA-f96h-pmfr-66vw2024-10-15

  Starlette Denial of service (DoS) via multipart/form-data

  Fixed in: 0.40.0

• GHSA-v5gw-mw7f-84px2023-05-17

  Starlette has Path Traversal vulnerability in StaticFiles

  Fixed in: 0.27.0

• GHSA-74m5-2c7w-9w3x2023-02-14

  MultipartParser denial of service with too many fields or files

  Fixed in: 0.25.0, 8c74c2c8dba7030154f8af18e016136bea1938fa