Asynchronous Framework Vulnerability in Starlette Affects File Uploads
CVE-2025-54121

5.3MEDIUM

Key Information:

Vendor

Encode

Status
Starlette
Vendor
CVE Published:
21 July 2025

What is CVE-2025-54121?

Starlette, an ASGI framework for building async web services in Python, has a vulnerability in its file upload handling. When processing multi-part forms with large files exceeding the default maximum spool size, it can block the main thread, preventing the acceptance of new connections. This occurs due to a flaw in the UploadFile code where it fails to adequately check if the rollover will be triggered by additional bytes. A fix is available in version 0.47.2.

Affected Version(s)

starlette < 0.47.2

References

https://github.com/encode/starlette/security/advisories/G...
x_refsource_CONFIRM
https://github.com/encode/starlette/commit/9f7ec2eb512fcc...
x_refsource_MISC
https://github.com/encode/starlette/blob/fa5355442753f794...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54121 : Asynchronous Framework Vulnerability in Starlette Affects File Uploads