Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Update dependency starlette to ^0.47.0 [SECURITY]#316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
renovate wants to merge1 commit intomain
base:main
Choose a base branch
Loading
fromrenovate/pypi-starlette-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovaterenovatebot commentedOct 15, 2024•
edited
Loading

This PR contains the following updates:

PackageChangeAgeConfidence
starlette (changelog)^0.38.0 ->^0.47.0ageconfidence

GitHub Vulnerability Alerts

CVE-2024-47874

Summary

Starlette treatsmultipart/form-data parts without afilename as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette.

PoC

fromstarlette.applicationsimportStarlettefromstarlette.routingimportRouteasyncdefpoc(request):asyncwithrequest.form():passapp=Starlette(routes=[Route('/',poc,methods=["POST"]),])
curl http://localhost:8000 -F'big=</dev/urandom'

Impact

This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.

CVE-2025-54121

Summary

When parsing a multi-part form with large files (greater than thedefault max spool size)starlette will block the main thread to roll the file over to disk. This blocks the event thread which means we can't accept new connections.

Details

Please see this discussion for details:https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403. In summary the following UploadFile code (copied fromhere) has a minor bug. Instead of just checking forself._in_memory we should also check if the additional bytes will cause a rollover.

    @&#8203;propertydef_in_memory(self)->bool:# check for SpooledTemporaryFile._rolledrolled_to_disk=getattr(self.file,"_rolled",True)returnnotrolled_to_diskasyncdefwrite(self,data:bytes)->None:ifself.sizeisnotNone:self.size+=len(data)ifself._in_memory:self.file.write(data)else:awaitrun_in_threadpool(self.file.write,data)

I have already created a PR which fixes the problem:https://github.com/encode/starlette/pull/2962

PoC

See the discussionhere for steps on how to reproduce.

Impact

To be honest, very low and not many users will be impacted. Parsing large forms is already CPU intensive so the additional IO block doesn't slow downstarlette that much on systems with modern HDDs/SSDs. If someone is running on tape they might see a greater impact.

Release Notes

Kludex/starlette (starlette)

v0.47.2

Compare Source

Fixed

  • MakeUploadFile check for future rollover#​2962.

New Contributors

Full Changelog:Kludex/starlette@0.47.1...0.47.2

v0.47.1: Version 0.47.1

Compare Source

Fixed

  • UseSelf inTestClient.__enter__#​2951
  • Allow async exception handlers to type-check#​2949

Full Changelog:Kludex/starlette@0.47.0...0.47.1

v0.47.0: Version 0.47.0

Compare Source

Added

  • Add support for ASGIpathsend extension#​2671.
  • Addpartitioned attribute toResponse.set_cookie#​2501.

Changed

  • Changemethods parameter type fromlist[str] toCollection[str]#​2903.
  • Replaceimport typing byfrom typing import ... in the whole codebase#​2867.

Fixed

  • MarkExceptionMiddleware.http_exception as async to prevent thread creation#​2922.

New Contributors

Full Changelog:Kludex/starlette@0.46.2...0.47.0

v0.46.2: Version 0.46.2

Compare Source

What's Changed

New Contributors

Full Changelog:Kludex/starlette@0.46.1...0.46.2

v0.46.1: Version 0.46.1

Compare Source

Fixed

  • Allow relative directory path whenfollow_symlinks=True#​2896.

Full Changelog:Kludex/starlette@0.46.0...0.46.1

v0.46.0: Version 0.46.0

Compare Source

Added

  • GZipMiddleware: Make sureVary header is always added if a response can be compressed#​2865.

Fixed

  • Raise exception from background task on BaseHTTPMiddleware#​2812.
  • GZipMiddleware: Don't compress on server sent events#​2871.

Changed

  • MultiPartParser: Renamemax_file_size tospool_max_size#​2780.

Deprecated

  • Add deprecated warning toTestClient(timeout=...)#​2840.

New Contributors

Full Changelog:Kludex/starlette@0.45.3...0.46.0

v0.45.3: Version 0.45.3

Compare Source

Fixed

Full Changelog:Kludex/starlette@0.45.2...0.45.3

v0.45.2: Version 0.45.2

Compare Source

Fixed
  • Makecreate_memory_object_stream compatible with old anyio versions once again, and bump anyio minimum version to 3.6.2 by@​graingert in#​2833.

Full Changelog:Kludex/starlette@0.45.1...0.45.2

v0.45.1: Version 0.45.1

Compare Source

Fixed
Refactor

Full Changelog:Kludex/starlette@0.45.0...0.45.1

v0.45.0: Version 0.45.0

Compare Source

Removed

Full Changelog:Kludex/starlette@0.44.0...0.45.0

v0.44.0: Version 0.44.0

Compare Source

Added

New Contributors

Full Changelog:Kludex/starlette@0.43.0...0.44.0

v0.43.0: Version 0.43.0

Compare Source

Removed

  • Remove deprecatedallow_redirects argument fromTestClient#​2808.

Added

  • Make UUID path parameter conversion more flexible#​2806.

New Contributors

Full Changelog:Kludex/starlette@0.42.0...0.43.0

v0.42.0: Version 0.42.0

Compare Source

Added

  • RaiseClientDisconnect onStreamingResponse#​2732.

Fixed

  • Use ETag from headers when parsing If-Range in FileResponse#​2761.
  • Follow directory symlinks inStaticFiles whenfollow_symlinks=True#​2711.
  • Bump minimumpython-multipart version to0.0.180ba8395.
  • Bump minimumhttpx version to0.27.0#​2773.

New Contributors

Full Changelog:Kludex/starlette@0.41.3...0.42.0

v0.41.3: Version 0.41.3

Compare Source

Fixed

  • Exclude the query parameters from thescope[raw_path] on theTestClient#​2716.
  • Replacedict byMapping onHTTPException.headers#​2749.
  • Correct middleware argument passing and improve factory pattern#​2752.

Full Changelog:Kludex/starlette@0.41.2...0.41.3

v0.41.2: Version 0.41.2

Compare Source

What's Changed

Full Changelog:Kludex/starlette@0.41.1...0.41.2

v0.41.1: Version 0.41.1

Compare Source

What's Changed

Full Changelog:Kludex/starlette@0.41.0...0.41.1

v0.41.0: Version 0.41.0

Compare Source

Added

  • Allow to raiseHTTPException beforewebsocket.accept()encode#2725

v0.40.0: Version 0.40.0

Compare Source

This release fixes a Denial of service (DoS) viamultipart/form-data requests.

You can view the full security advisory:
GHSA-f96h-pmfr-66vw

Fixed

  • Addmax_part_size toMultiPartParser to limit the size of parts inmultipart/form-data
    requestsfd038f3.

v0.39.2: Version 0.39.2

Compare Source

Fixed

  • Allow use ofrequest.url_for when only "app" scope is available#​2672.
  • Fix internal type hints to supportpython-multipart==0.0.12#​2708.

Full Changelog:Kludex/starlette@0.39.1...0.39.2

v0.39.1: Version 0.39.1

Compare Source

Fixed

  • Avoid regex re-compilation inresponses.py andschemas.py#​2700.
  • Improve performance ofget_route_path by removing regular expression usage#​2701.
  • ConsiderFileResponse.chunk_size when handling multiple ranges#​2703.
  • Usetoken_hex for generating multipart boundary strings#​2702.

Full Changelog:Kludex/starlette@0.39.0...0.39.1

v0.39.0: Version 0.39.0

Compare Source

Added

  • Add support for HTTP Range toFileResponse#​2697

Full Changelog:Kludex/starlette@0.38.6...0.39.0

v0.38.6: Version 0.38.6

Compare Source

Fixed

  • Close unclosedMemoryObjectReceiveStream inTestClient#​2693.

Full Changelog:Kludex/starlette@0.38.5...0.38.6

v0.38.5: Version 0.38.5

Compare Source

Fixed

  • ScheduleBackgroundTasks from withinBaseHTTPMiddleware#​2688.
    This behavior was removed in 0.38.3, and is now restored.

Full Changelog:Kludex/starlette@0.38.4...0.38.5

v0.38.4: Version 0.38.4

Compare Source

Fixed

  • Ensure accurateroot_path removal inget_route_path function#​2600

Full Changelog:Kludex/starlette@0.38.3...0.38.4

v0.38.3: Version 0.38.3

Compare Source

Added
Fixed
  • Don't poll for disconnects inBaseHTTPMiddleware viaStreamingResponse#​2620.

Full Changelog:Kludex/starlette@0.38.2...0.38.3

v0.38.2: Version 0.38.2

Compare Source

Fixed

  • Fixrouting.get_name() not to assume all routines have__name__#​2648

Full Changelog:Kludex/starlette@0.38.1...0.38.2

v0.38.1: Version 0.38.1

Compare Source

Removed

  • Revert "Add support for ASGI pathsend extension"#​2649.

Full Changelog:Kludex/starlette@0.38.0...0.38.1

Configuration

📅Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated byMend Renovate. View therepository job log.

@renovaterenovatebot requested a review fromks129 as acode ownerOctober 15, 2024 19:18
@renovaterenovatebotforce-pushed therenovate/pypi-starlette-vulnerability branch 2 times, most recently from1c29c1d to9b996d5CompareJune 6, 2025 02:34
@renovaterenovatebotforce-pushed therenovate/pypi-starlette-vulnerability branch from9b996d5 to79f6a6aCompareJuly 21, 2025 23:31
@renovaterenovatebot changed the titleUpdate dependency starlette to ^0.40.0 [SECURITY]Update dependency starlette to ^0.47.0 [SECURITY]Jul 21, 2025
@renovaterenovatebotforce-pushed therenovate/pypi-starlette-vulnerability branch from79f6a6a toe9f6bbfCompareJuly 22, 2025 19:56
@renovaterenovatebotforce-pushed therenovate/pypi-starlette-vulnerability branch frome9f6bbf to7f751a1CompareAugust 9, 2025 00:44
@renovaterenovatebotforce-pushed therenovate/pypi-starlette-vulnerability branch from7f751a1 to1400967CompareOctober 28, 2025 22:09
@renovaterenovatebot changed the titleUpdate dependency starlette to ^0.47.0 [SECURITY]Update dependency starlette to ^0.49.0 [SECURITY]Oct 28, 2025
| datasource | package   | from   | to     || ---------- | --------- | ------ | ------ || pypi       | starlette | 0.38.0 | 0.47.2 |
@renovaterenovatebotforce-pushed therenovate/pypi-starlette-vulnerability branch from1400967 toc561b8fCompareNovember 4, 2025 21:09
@renovaterenovatebot changed the titleUpdate dependency starlette to ^0.49.0 [SECURITY]Update dependency starlette to ^0.47.0 [SECURITY]Nov 4, 2025
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@ks129ks129Awaiting requested review from ks129ks129 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

[8]ページ先頭
©2009-2025 Movatter.jp