starlette has 9 CVEs on record between 2023 and 2026. The busiest recent month was June 2026 with 3. The median CVSS is 5.3 (medium). 11% have been exploited in the wild, in line with the corpus average.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 11% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —(1)
- Last 90 days
- 0 prev 4
Weakness classes
Products
- starlette 9
Worst active — by depth score
CVE-2026-48710Medium· 6.5Starlette is a lightweight ASGI framework/toolkit68CVE-2025-62727High· 7.5Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``53CVE-2023-30798High· 7.5MultipartParser denial of service with too many fields or files42CVE-2026-48818High· 7.5Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows41CVE-2026-48817Medium· 5.3Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`29
starlette vulnerabilities
CVEs affecting starlette, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-48817Medium· 5.3Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
CVE-2026-48818High· 7.5Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
CVE-2026-54282Low· 3.7Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
CVE-2026-48710Medium· 6.5CISA KEVPoCStarlette is a lightweight ASGI framework/toolkit
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `…
CVE-2025-62727High· 7.5PoCStarlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
CVE-2025-54121Medium· 5.3Starlette has possible denial-of-service vector when parsing large files in multipart forms
Starlette has possible denial-of-service vector when parsing large files in multipart forms
CVE-2024-47874None· 0.0Starlette Denial of service (DoS) via multipart/form-data
Starlette Denial of service (DoS) via multipart/form-data
CVE-2023-29159Low· 3.7Starlette has Path Traversal vulnerability in StaticFiles
Starlette has Path Traversal vulnerability in StaticFiles
CVE-2023-30798High· 7.5MultipartParser denial of service with too many fields or files
MultipartParser denial of service with too many fields or files