CVE-2025-54121
📋 TL;DR
A denial-of-service vulnerability in Starlette's file upload handling allows attackers to block the main event loop by sending large multipart form files. This affects all Python web applications using Starlette 0.47.1 and below with file upload functionality. The vulnerability prevents the application from accepting new connections while processing oversized files.
💻 Affected Systems
- Starlette
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete application unavailability for all users during file upload processing, potentially leading to extended service disruption.
Likely Case
Temporary denial of service affecting new connections while large files are being processed, degrading application performance.
If Mitigated
Minimal impact with proper rate limiting, file size restrictions, and monitoring in place.
🎯 Exploit Status
Exploitation requires sending HTTP requests with large multipart form files. No authentication needed if upload endpoint is publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.47.2
Vendor Advisory: https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73
Restart Required: Yes
Instructions:
1. Update Starlette: pip install --upgrade starlette==0.47.2
2. Restart your application server
3. Verify the version with: python -c "import starlette; print(starlette.__version__)"
🔧 Temporary Workarounds
Limit maximum file size
allConfigure application to reject files larger than a safe threshold before Starlette processes them
# In your FastAPI/Starlette app:
# app = FastAPI()
# @app.post('/upload')
# async def upload(file: UploadFile = File(...)):
# if file.size > MAX_SIZE:
# raise HTTPException(status_code=413, detail='File too large')
Implement request timeout
allAdd middleware to timeout long-running requests before they block the event loop
# Using asyncio timeout:
import asyncio
from starlette.middleware.base import BaseHTTPMiddleware
class TimeoutMiddleware(BaseHTTPMiddleware):
async def dispatch(self, request, call_next):
try:
return await asyncio.wait_for(call_next(request), timeout=30.0)
except asyncio.TimeoutError:
return Response('Request timeout', status_code=408)
🧯 If You Can't Patch
- Implement reverse proxy rate limiting (e.g., nginx limit_req) to restrict upload request frequency
- Deploy Web Application Firewall (WAF) rules to detect and block large file upload attempts
🔍 How to Verify
Check if Vulnerable:
Check Starlette version: python -c "import starlette; print('Vulnerable' if starlette.__version__ <= '0.47.1' else 'Patched')"Check Version:
python -c "import starlette; print(f'Starlette version: {starlette.__version__}')"Verify Fix Applied:
Confirm version is 0.47.2 or higher: python -c "import starlette; print(starlette.__version__)"📡 Detection & Monitoring
Log Indicators:
- Unusually long request processing times for POST requests to upload endpoints
- Increased 408 timeout errors
- Application restart events following file uploads
Network Indicators:
- Large HTTP POST requests (> default spool size) to upload endpoints
- Multiple concurrent large file upload requests
SIEM Query:
source='application.logs' AND (message LIKE '%upload%' AND duration_ms > 30000) OR (status_code=408 AND uri_path LIKE '%upload%')🔗 References
- https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14
- https://github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1
- https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403
- https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73
