Kludex vulnerabilities

Products

• Python-multipart 9
• Starlette 6

Newest

• encode starlette Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS CVE-2026-54283 Fix available 7.5 HighJune 15, 2026
• encode starlette Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname CVE-2026-54282 Fix available 3.7 LowJune 15, 2026
• fastapiexpert python-multipart Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service CVE-2026-53539 Fix available 7.5 HighJune 15, 2026
• fastapiexpert python-multipart Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory CVE-2026-53540 Fix available 3.7 LowJune 15, 2026
• fastapiexpert python-multipart Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling CVE-2026-53538 Fix available 3.7 LowJune 15, 2026
• fastapiexpert python-multipart Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters CVE-2026-53537 Fix available 3.7 LowJune 15, 2026
• encode starlette, red hat exploit intelligence, migration toolkit for applications 8 +8 more +10 more Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows CVE-2026-48818 Fix available 7.5 HighJune 15, 2026
• encode starlette Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` CVE-2026-48817 Fix available 5.3 MediumJune 15, 2026
• encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 more Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-48710 In KEVPublic exploitFix available EPSS 70.3% 6.5 MediumMay 22, 2026
• kludex python-multipart, red hat exploit intelligence, openshift lightspeed +11 more +13 more Python-Multipart: Denial of Service via unbounded multipart part headers CVE-2026-42561 Fix available 7.5 HighMay 6, 2026
• fastapiexpert python-multipart Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data CVE-2026-40347 Fix available 5.3 MediumApril 15, 2026
• fastapiexpert python-multipart, red hat lightspeed core, openshift lightspeed +11 more +13 more Python-Multipart has Arbitrary File Write via Non-Default Configuration CVE-2026-24486 Public exploitFix available 8.6 HighJanuary 26, 2026
• encode starlette Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse CVE-2025-62727 Public exploitFix available 7.5 HighOctober 28, 2025
• kludex python-multipart python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary CVE-2024-53981 Fix available 7.5 HighDecember 2, 2024
• fastapiexpert python-multipart, encode starlette, tiangolo fastapi +2 more python-multipart vulnerable to content-type header Regular expression Denial of Service CVE-2024-24762 Fix available 7.5 HighFebruary 5, 2024