kludex/starlette Security Advisories | GitStock

high2026-06-15

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

GHSA-82w8-qh3p-5jfq · CVE-2026-54283

low2026-06-15

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

GHSA-jp82-jpqv-5vv3 · CVE-2026-54282

high2026-06-15

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

GHSA-wqp7-x3pw-xc5r · CVE-2026-48818

medium2026-06-15

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

GHSA-x746-7m8f-x49c · CVE-2026-48817

medium2026-06-04

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

GHSA-86qp-5c8j-p5mr · CVE-2026-48710

high2025-10-28

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

GHSA-7f5h-v6xp-fcq8 · CVE-2025-62727