PT-2025-30341 · Starlette+2 · Starlette+2

Honakerm · Published 2025-07-21 · Updated 2026-02-10 · CVE-2025-54121

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Starlette versions 0.47.1 and below

Description Starlette is a lightweight ASGI framework/toolkit for building async web services in Python. When parsing multi-part forms with large files exceeding the default maximum spool size, Starlette blocks the main thread to transfer the file to disk. This blockage impacts the event thread, preventing the application from accepting new connections. The issue stems from a flaw in the UploadFile code where the logic fails to account for potential rollovers caused by additional bytes.

Recommendations Update to Starlette version 0.47.2 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-10819

CVE-2025-54121

GHSA-2C2J-9GV5-CJ73

OPENSUSE-SU-2025:15381-1

SUSE-SU-2025:02544-1

Affected Products

Debian

Red Os

Starlette

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54121.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54121 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-54121 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10819 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54121 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54121 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02544-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-54121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54121 · Security Note
• https://osv.dev/vulnerability/GHSA-2c2j-9gv5-cj73 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-54121 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15381-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54121 · Security Note
• https://github.com/encode/starlette · Note