A Denial of Service (DoS) vulnerability was discovered in starlette prior to 0.25.0. The MultipartParser using the package python-multipart accepts an unlimited number of multipart parts (form fields or files). Processing too many parts results in high CPU usage and high memory usage, eventually leading to an OOM process kill. This can be triggered by sending too many small form fields with no content, or too many empty files.
WS-2023-0037 - High Severity Vulnerability
The little ASGI library that shines.
Library home page: https://files.pythonhosted.org/packages/51/37/8ac52116984d6a0d8502ec2c7e4a4a78f862b76410cdb1a4bcb384c91cb3/starlette-0.20.4-py3-none-any.whl
Path to dependency file: /src/project/ai-rag-llm/ollama-repo-changes/requirements.txt
Path to vulnerable library: /tmp/ws-ua_20241123173544_ZRDILV/python_ACKMZH/202411231737521/env/lib/python3.8/site-packages/starlette-0.20.4.dist-info
Dependency Hierarchy: - :x: **starlette-0.20.4-py3-none-any.whl** (Vulnerable Library)
Found in HEAD commit: 92e57f9e81da15812523bf929f8ad33bdae5e967
Found in base branch: main
A Denial of Service (DoS) vulnerability was discovered in starlette prior to 0.25.0. The MultipartParser using the package python-multipart accepts an unlimited number of multipart parts (form fields or files). Processing too many parts results in high CPU usage and high memory usage, eventually leading to an OOM process kill. This can be triggered by sending too many small form fields with no content, or too many empty files.
Publish Date: 2023-02-14
URL: WS-2023-0037
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-74m5-2c7w-9w3x
Release Date: 2023-02-14
Fix Resolution: 0.26.0
Step up your Open Source Security Game with Mend here