CVE-2023-30798
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
The vulnerability in the Starlette Python framework before version 0.25.0 allows an unauthenticated remote attacker to specify an arbitrary number of form fields or files, causing excessive memory usage and denial of service (DoS) of the HTTP service.
Risk Assessment
The attack can exhaust server memory, disrupting Starlette-based web applications and leading to service unavailability for users.
Recommendation
Immediately upgrade Starlette to version 0.25.0 or later, which includes a fix limiting the number of form fields and files.
Other vulnerabilities in Starlette
See all- CVE-2026-48818High
A vulnerability in Starlette 1.0.1 and earlier on Windows allows SSRF via UNC paths. When the server validates the path, it sends an SMB request to the attacker, leaking NTLMv2 credentials. The issue affects default follow_symlink=False deployments, including frameworks like FastAPI.
- CVE-2026-48710Medium
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed.
Original NVD description (English source)
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.