TI-2026-35991 CVE-2026-48710 · GHSA-86qp-5c8j-p5mr
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Priority CRITICAL 86KEV
Starlette is a lightweight ASGI framework/toolkit.
encode
Records19All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
encode records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
19 records
TI-2024-32128 CVE-2024-47874 · GHSA-f96h-pmfr-66vw
Starlette Denial of service (DoS) via multipart/form-data
Priority HIGH 77
Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit.
TI-2026-78981 CVE-2026-114138 · GHSA-33wh-fxxf-88vv
Django REST framework Accept header parsing causes excessive CPU use
Priority HIGH 72
Django REST framework is a toolkit for building Web APIs.
TI-2026-78978 CVE-2026-114136 · GHSA-3547-9m27-7rxg
Django REST framework JSONParser accepts attacker-chosen codecs
Priority HIGH 72
Django REST framework is a toolkit for building Web APIs.
TI-2024-16279 CVE-2024-24762 · GHSA-2jv5-9r88-3w3p
python-multipart vulnerable to content-type header Regular expression Denial of Service
Priority HIGH 72
`python-multipart` is a streaming multipart parser for Python.
TI-2023-13590 CVE-2023-29159 · GHSA-v5gw-mw7f-84px
Path traversal in encode Starlette
Priority HIGH 72
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
TI-2026-51365 CVE-2026-73228 · GHSA-2m8g-3cmr-wg3w
Uncontrolled resource consumption in encode django-rest-framework
Priority MEDIUM 63
Django REST framework is a toolkit for building Web APIs.
TI-2025-33964 CVE-2025-54121 · GHSA-2c2j-9gv5-cj73
Starlette has possible denial-of-service vector when parsing large files in multipart forms
Priority MEDIUM 57
Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python.
TI-2026-51366 CVE-2026-73229 · GHSA-g47c-3xmw-q6m2
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Priority MEDIUM 53
Django REST framework is a powerful and flexible toolkit for building Web APIs.
TI-2021-18501 CVE-2021-41945 · GHSA-h8pj-cxx2-jfg2
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`…
Priority MEDIUM 43
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
TI-2023-14608 CVE-2023-30798 · GHSA-74m5-2c7w-9w3x
MultipartParser DOS with too many fields or files in Starlette Framework
Priority MEDIUM 41
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage…
TI-2026-39183 CVE-2026-54283 · GHSA-82w8-qh3p-5jfq
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Priority LOW 39
Starlette is a lightweight ASGI framework/toolkit.
TI-2026-36087 CVE-2026-48818 · GHSA-wqp7-x3pw-xc5r
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Priority LOW 39
Starlette is a lightweight ASGI framework/toolkit.
TI-2020-06214 CVE-2020-7694 · GHSA-33c7-2mpw-hg34
Log injection in uvicorn
Priority LOW 36
This affects all versions of package uvicorn.
TI-2026-78980 CVE-2026-114137 · GHSA-xw6w-gcfp-cf8m
TokenProxy.delete() in Django REST framework silently revokes nothing
Priority LOW 35
Django REST framework is a toolkit for building Web APIs.
TI-2020-15644 CVE-2020-25626 · GHSA-fx83-3ph3-9j2q
Improper input validation in Django REST Framework
Priority LOW 30
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2.
TI-2026-36086 CVE-2026-48817 · GHSA-x746-7m8f-x49c
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Priority LOW 29
Starlette is a lightweight ASGI framework/toolkit.
TI-2020-06215 CVE-2020-7695 · GHSA-f97h-2pfx-f59f
HTTP response splitting in uvicorn
Priority LOW 27
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting.
TI-2026-39182 CVE-2026-54282 · GHSA-jp82-jpqv-5vv3
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Priority LOW 24
Starlette is a lightweight ASGI framework/toolkit.