CVE-2025-54121 Starlette has possible denial-of-service vector when parsing large files in multipart forms

🗓️ 21 Jul 2025 20:06:03Reported by GitHub_MType

Starlette has a denial-of-service issue parsing large multipart form files in versions 0.47.1 and below

Reporter	Title	Published	Views	Family All 52
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Starlette (CVE-2025-54121)	26 Mar 202611:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	17 Dec 202509:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software	27 Nov 202512:09	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to event thread locking due to the starlette package (CVE-2025-54121)	20 Nov 202514:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	20 Nov 202504:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	21 Jan 202605:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	28 Aug 202507:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Business Automation Workflow Machine Learning Server are addressed with 24.0.0-IF007	7 Nov 202517:54	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	19 Dec 202520:44	–	ibm

[
  {
    "vendor": "encode",
    "product": "starlette",
    "versions": [
      {
        "version": "< 0.47.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73
github	www.github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py
github	www.github.com/encode/starlette/discussions/2927
github	www.github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1

21 Jul 2025 20:06Current

CVSS 3.15.3

EPSS0.00504

CWE-770