DEBIAN-CVE-2025-54121

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2025-54121
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54121.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-54121
Upstream
Published
2025-07-21T20:15:41.827Z
Modified
2025-11-20T10:18:24.536702Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self.inmemory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.

References

Affected packages

Debian:11 / starlette

Package

Name
starlette
Purl
pkg:deb/debian/starlette?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.14.1-1
0.16.0-1
0.18.0-1
0.20.4-1
0.23.1-1
0.24.0-1
0.25.0-1
0.25.0-2
0.26.1-1
0.28.0-1
0.30.0-1
0.31.1-1
0.37.2-1
0.38.2-1
0.39.1-1
0.39.2-1
0.41.0-1
0.41.2-1
0.41.3-1
0.41.3-2
0.46.1-1
0.46.1-2
0.46.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / starlette

Package

Name
starlette
Purl
pkg:deb/debian/starlette?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.26.1-1
0.28.0-1
0.30.0-1
0.31.1-1
0.37.2-1
0.38.2-1
0.39.1-1
0.39.2-1
0.41.0-1
0.41.2-1
0.41.3-1
0.41.3-2
0.46.1-1
0.46.1-2
0.46.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / starlette

Package

Name
starlette
Purl
pkg:deb/debian/starlette?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.46.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / starlette

Package

Name
starlette
Purl
pkg:deb/debian/starlette?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.46.1-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}