PT-2025-30341 · Starlette+2 · Starlette+2

Honakerm · Publicado 2025-07-21 · Atualizado 2026-06-03 · CVE-2025-54121

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Starlette versions 0.47.1 and below

Description Starlette is a lightweight ASGI framework/toolkit for building async web services in Python. When parsing multi-part forms with large files exceeding the default maximum spool size, Starlette blocks the main thread to transfer the file to disk. This blockage impacts the event thread, preventing the application from accepting new connections. The issue stems from a flaw in the UploadFile code where the logic fails to account for potential rollovers caused by additional bytes.

Recommendations Update to Starlette version 0.47.2 or later.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BDU:2025-10819

CVE-2025-54121

GHSA-2C2J-9GV5-CJ73

OPENSUSE-SU-2025:15381-1

SUSE-SU-2025:02544-1

Produtos afetados

Debian

Red Os

Starlette

Referências · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54121.json · Exploit
• https://github.com/encode/starlette · Nota
• https://github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1 · Nota
• https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403 · Nota
• https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73 · Nota
• https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14 · Nota
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-54121 · Aviso do Fabricante
• https://twitter.com/Cezar_H_Linux/status/1950498193105440814 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2025-54121 · Aviso do Fabricante
• https://twitter.com/Cezar_H_Linux/status/1950503300450676862 · Publicação no Twitter
• https://suse.com/ko-kr/security/cve/CVE-2025-54121.html · Nota
• https://suse.com/security/cve/CVE-2025-54121 · Nota
• https://osv.dev/vulnerability/GHSA-2c2j-9gv5-cj73 · Aviso do Fabricante
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-54121 · Nota de Segurança