Skip to main content

CVE-2025-54121: CWE-770: Allocation of Resources Without Limits or Throttling in encode starlette

Medium
VulnerabilityCVE-2025-54121cvecve-2025-54121cwe-770
Published: Mon Jul 21 2025 (07/21/2025, 20:06:03 UTC)
Source: CVE Database V5
Vendor/Project: encode
Product: starlette

Description

Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.

Technical Details

Data Version
5.1
Assigner Short Name
GitHub_M
Date Reserved
2025-07-16T23:53:40.508Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 687ea00aa83201eaac13ae53

Added to database: 7/21/2025, 8:16:10 PM

Last updated: 7/21/2025, 8:16:10 PM

Views: 1

Actions

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats