Описание
Security update for python-starlette
This update for python-starlette fixes the following issues
- CVE-2025-54121: denial-of-service when parsing a multi-part form with large files (bsc#1246855).
- CVE-2025-62727: DoS via Range header merging (bsc#1252805).
- CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassing path-based security checks (bsc#1266369).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1246855
- SUSE Bug 1252805
- SUSE Bug 1266369
- SUSE CVE CVE-2025-54121 page
- SUSE CVE CVE-2025-62727 page
- SUSE CVE CVE-2026-48710 page
Описание
Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.
Затронутые продукты
Ссылки
- CVE-2025-54121
- SUSE Bug 1246855
Описание
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial-of-service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
Затронутые продукты
Ссылки
- CVE-2025-62727
- SUSE Bug 1252805
Описание
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Затронутые продукты
Ссылки
- CVE-2026-48710
- SUSE Bug 1266369