Threat database

The pyasn1 library contains a vulnerability that allows an attacker to cause a Denial of Service (DoS) by supplying ASN.1 data with deeply nested indefinite-length SEQUENCE or SET tags. This triggers unbounded recursion in the decoder, leading to a RecursionError or out-of-memory crash. Services parsing untrusted ASN.1 data using pyasn1 are at risk of crashing or resource exhaustion. A patch is available in version 0.6.1_1.

A denial-of-service (DoS) vulnerability exists in pyasn1 version 0.6.1 due to memory exhaustion caused by malformed RELATIVE-OID values with excessive continuation octets during decoding. An attacker can exploit this by crafting malicious ASN.1 packets, such as X.509 certificates, that cause the decoder to consume excessive memory and potentially hang or crash affected services. This impacts applications that decode ASN.1 data, including LDAP servers, TLS/SSL endpoints, and OCSP responders. A fix is available in pyasn1 version 0.6.0_2.

The httplib2 HTTP client library is vulnerable to a decompression bomb denial of service (DoS) attack via unbounded gzip or deflate response handling. A malicious HTTP server can send a small compressed payload that decompresses to a very large size in memory, causing the client process to run out of memory or crash. This affects any application using httplib2.Http().request() with untrusted HTTP endpoints. The vulnerability arises because the library decompresses entire gzip or deflate payloads without size limits or checks. A fix is available in version 0.6.3_4.

A vulnerability in the pyasn1 library's univ.Real type allows an attacker to cause excessive CPU and memory consumption when converting decoded REAL values with large exponents to Python floats. This can lead to denial of service in applications that decode untrusted ASN.1 data and then perform float conversions such as printing, logging, or comparisons. The issue is fixed in pyasn1 version 0.6.4 and later.

A denial of service vulnerability exists in pyasn1's BER/CER/DER decoders and encoders when processing OBJECT IDENTIFIER and RELATIVE-OID values. The processing time grows quadratically with the number of arcs, allowing a crafted payload with many arcs to consume excessive CPU time. This affects applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, and Kerberos. The issue is fixed in pyasn1 version 0.6.4, which improves performance to linear time.

A denial of service vulnerability exists in the pyasn1 BER/CER/DER decoder used by the Glances product. The decoder processes long-form tag IDs without an upper bound, allowing crafted inputs to cause excessive CPU consumption or unhandled exceptions. This affects applications decoding untrusted BER/CER/DER inputs using pyasn1 versions before the fixed releases. The issue is fixed in pyasn1 version 0.6.4 and corresponding Glances versions.

Starlette's request.form() method does not enforce configured limits on the number and size of fields for application/x-www-form-urlencoded content types, unlike multipart/form-data. This allows an unauthenticated attacker to send requests with extremely large numbers of fields or very large field sizes, causing denial of service by blocking the event loop or exhausting memory. The vulnerability affects Starlette and FastAPI applications using request.form() on urlencoded requests. A patch is available in version 4.5.5 that enforces these limits properly.

A vulnerability in Starlette versions >=4.2.1 and <4.5.5 allows an attacker to manipulate the reconstructed request URL by providing a request path that does not start with a slash. This causes the hostname in request.url to be attacker-controlled, potentially misleading security-sensitive code that relies on request.url.hostname. The issue is mitigated in version 4.5.5 and later.

Starlette's HTTPEndpoint dispatches HTTP methods by lowercasing the method name and using getattr without restricting to known HTTP verbs. If an HTTPEndpoint subclass is registered via Route without specifying allowed methods, non-standard HTTP methods can invoke internal attributes as handlers. This can lead to unauthorized invocation of internal methods. The issue affects Starlette and frameworks built on it, such as FastAPI. The vulnerability is patched in version 4.5.5.

A vulnerability in Starlette, a lightweight ASGI framework, allows an attacker to send a malformed HTTP Host header that causes the reconstructed request.url.path to differ from the actual requested path. This discrepancy can lead to bypassing path-based security checks if the application relies on request.url.path for authorization decisions. The flaw affects versions from 4.2.1 up to but not including 4.5.4_3. A fix is available in version 4.5.4_3. The impact depends on application design and is rated medium severity with a CVSS score of 6.5. Mitigation includes upgrading to a patched version or deploying a reverse proxy that validates Host headers according to RFC standards.

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing and merging logic that leads to quadratic-time complexity. An unauthenticated attacker can craft a Range header with many small, disjoint ranges to cause excessive CPU consumption per request, resulting in denial-of-service (DoS) conditions for endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, including frameworks built on Starlette such as FastAPI. The vulnerability is identified as CVE-2025-62727 and has a CVSS score of 7.5 (high severity). A fix is available in Starlette version 4.3.3_2.

CVE-2025-54121 is a denial-of-service vulnerability in the Starlette framework used by Glances when parsing multipart forms with large files. The issue occurs because the main event thread is blocked during file rollover to disk, preventing new connections. The impact is considered low to medium, mainly affecting systems with slower disk I/O. A fix is available in Glances version 4.3.3_1.

Starlette, a Python web framework used by applications such as Glances and FastAPI, has a denial of service (DoS) vulnerability (CVE-2024-47874) related to handling multipart/form-data requests. Specifically, parts without a filename are treated as text form fields and buffered without size limits, allowing attackers to upload arbitrarily large form fields. This can cause excessive memory consumption, server slowdowns, and potential process termination due to out-of-memory (OOM) conditions. The vulnerability affects all Starlette-based applications accepting form requests prior to version 4.5.6.