Read the docs
TI-2023-10881 Aliases CVE-2023-25578GHSA-p24m-863f-fm6q

Starlite DoS vulnerability when parsing multipart request body

Priority HIGH 72CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This is a remote, potentially unauthenticated Denial of Service vulnerability. This vulnerability affects applications with a request handler that accepts a `Body(media_type=RequestEncodingType.MULTI_PART)`. The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop. Version 1.51.2 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01004 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed starlite (starlite-api): 1.51.2starlite (PyPI): 1.51.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
starlite-apistarlitebefore 1.51.21.51.2Patch availableCNA
—starlite (PyPI)before 1.51.21.51.2Patch availableGHSA-p24m-863f-fm6q
  • starlite Vendorstarlite-api Affected before 1.51.2 Fixed in 1.51.2 Patch available CNA
  • starlite (PyPI) Vendor— Affected before 1.51.2 Fixed in 1.51.2 Patch available GHSA-p24m-863f-fm6q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:starliteproject:starlite:*:*:*:*:*:*:*:*before 1.51.2VulnerableStarliteproject
  • cpe:2.3:a:starliteproject:starlite:*:*:*:*:*:*:*:* Versions before 1.51.2 Vulnerable ·Starliteproject

Remediation

  • Fix · CNA starlite (starlite-api) Fixed in 1.51.2
  • Fix · GHSA-p24m-863f-fm6q starlite (PyPI) Fixed in 1.51.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25578
  2. 2026-10-03 Alias added: GHSA-p24m-863f-fm6q

References

Sources