Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. starlette
  4. ›
  5. GMS-2023-353

GMS-2023-353: MultipartParser denial of service with too many fields or files

February 14, 2023

The MultipartParser using the package python-multipart accepts an unlimited number of multipart parts (form fields or files). Processing too many parts results in high CPU usage and high memory usage, eventually leading to an OOM process kill. This can be triggered by sending too many small form fields with no content, or too many empty files. For this to take effect application code has to; have python-multipart installed and call request.form() or via another framework like FastAPI, using form field parameters or UploadFile parameters, which in turn calls request.form().

References

  • github.com/advisories/GHSA-74m5-2c7w-9w3x
  • github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x

Code Behaviors & Features

Detect and mitigate GMS-2023-353 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.25.0

Fixed versions

  • 0.25.0

Solution

Upgrade to version 0.25.0 or above.

Source file

pypi/starlette/GMS-2023-353.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:26 +0000.