GHSA-3qj8-93xh-pwh2
Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files
GHSA-3qj8-93xh-pwh2 is a high vulnerability (CVSS 7.5) in starlette, published April 21, 2023. No source lists public exploit code. Fixed in starlette 0.22.0+aikido.7.
- Severity
- 7.5 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.22.0+aikido.7starlette
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-74m5-2c7w-9w3x. This link is maintained to preserve external references.
Original Description
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
starletteRoot:PyPI | before 0.22.0+aikido.7 | 0.22.0+aikido.70.22.0+aikido.6 |
What each source reports
GitHub Advisories Score used
Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-74m5-2c7w-9w3x. This link is maintained to preserve external references.
Original Description
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
- Record
GHSA-3qj8-93xh-pwh2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Duplicate Advisory: Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-74m5-2c7w-9w3x. This link is maintained to preserve external references.
Original Description
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
- Record
GHSA-3qj8-93xh-pwh2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVROOT-APP-PYPI-GHSA-3qj8-93xh-pwh2No score
GHSA-3qj8-93xh-pwh2 in starlette - Patched by Root
Root has patched GHSA-3qj8-93xh-pwh2 in the starlette package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-GHSA-3qj8-93xh-pwh2- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x
nvd.nist.gov/vuln/detail/CVE-2023-30798
vulncheck.com/advisories/starlette-multipartparser-dos