sr2/cloud-api
6
0
Fork 1
Code Issues 8 Pull requests 1 Projects Releases Packages 1 Wiki Activity Actions

chore(deps): update dependency starlette to v1.3.1 [security] #32

Merged
irl merged 1 commit from renovate/pypi-starlette-vulnerability into main 2026-06-25 06:43:07 +00:00
Conversation 0 Commits 1 Files changed 1 +3 -3
renovate commented 2026-06-22 15:55:01 +00:00
Member
Copy link

This PR contains the following updates:

Package Change Age Confidence
starlette (changelog) 1.1.0 → 1.3.1 age confidence

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

CVE-2026-54282 / GHSA-jp82-jpqv-5vv3

More information

Details

Summary

In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host.

Details

When a client requests a path that does not start with /:

GET @​google.com HTTP/1.1
Host: localhost

affected versions reconstruct the URL as http://localhost@google.com. Per RFC 3986 §3.2.1, the substring before @ in the authority is userinfo, so re-parsing yields username = "localhost" and hostname = "google.com", with an empty path:

request.url          == "http://localhost@google.com"
request.url.hostname == "google.com"
request.url.path     == ""

The root cause is that the path is concatenated directly after the host without a separating /, and without validating that it begins with one. Only the Host header was validated when constructing request.url; the path was not.

This requires an ASGI server that forwards a request-target lacking a leading / into scope["path"].

Impact

Any application running an affected version that uses request.url, request.url.netloc, or request.url.hostname for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first.

Note that this is less exploitable than GHSA-86qp-5c8j-p5mr: there, the poison is carried in the Host header, so the real path still routes to a valid endpoint while request.url.path lies. Here, the poison must be carried in the path itself, and that path (@google.com) does not match any registered route, so routing returns 404 and no endpoint handler runs. The exposure is limited to code that reads request.url before routing - notably middleware - or in 404/exception handlers.

Mitigation

Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields http://localhost/@​google.com with request.url.hostname == "localhost".

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

CVE-2026-54283 / GHSA-82w8-qh3p-5jfq

More information

Details

Summary

request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.

Details

request.form() dispatches to a different parser depending on the Content-Type. For multipart/form-data the max_files, max_fields, and max_part_size limits are forwarded to the parser, but for application/x-www-form-urlencoded the parser is constructed without them. It has no max_fields or max_part_size parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.

Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:

  • Field count drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as f0=v&f1=v&...) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.
  • Field size drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the FormData, forcing memory allocation proportional to the request body.

The equivalent multipart/form-data request is correctly rejected with 400 Too many fields / 400 Field exceeded maximum size.

Impact

This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call request.form() on application/x-www-form-urlencoded requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.

Mitigation

Upgrade to a patched version, which forwards max_fields and max_part_size to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match multipart/form-data (max_fields=1000, max_part_size=1MB) and can be customized via request.form(max_fields=..., max_part_size=...).

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

Kludex/starlette (starlette)

v1.3.1: Version 1.3.1

Compare Source

What's Changed

Full Changelog: https://github.com/Kludex/starlette/compare/1.3.0...1.3.1

v1.3.0: Version 1.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/Kludex/starlette/compare/1.2.1...1.3.0

v1.2.1: Version 1.2.1

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/Kludex/starlette/compare/1.2.0...1.2.1

v1.2.0: Version 1.2.0

Compare Source

What's Changed

Full Changelog: https://github.com/Kludex/starlette/compare/1.1.0...1.2.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [starlette](https://github.com/Kludex/starlette) ([changelog](https://starlette.dev/release-notes/)) | `1.1.0` → `1.3.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/starlette/1.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/starlette/1.1.0/1.3.1?slim=true) | --- ### Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname [CVE-2026-54282](https://nvd.nist.gov/vuln/detail/CVE-2026-54282) / [GHSA-jp82-jpqv-5vv3](https://github.com/advisories/GHSA-jp82-jpqv-5vv3) <details> <summary>More information</summary> #### Details ##### Summary In affected versions, the HTTP request path is not validated before being used to reconstruct `request.url`. Because `request.url` is rebuilt by concatenating `{scheme}://{host}{path}` and re-parsing the result, a path that does not begin with `/` (for example `@google.com`) moves the authority boundary during re-parsing, so `request.url.hostname` and `request.url.netloc` become attacker-controlled. Code that reads `request.url.hostname` (rather than the `Host` header or `scope`) can therefore be misled into trusting an attacker-supplied host. ##### Details When a client requests a path that does not start with `/`: ```http GET @&#8203;google.com HTTP/1.1 Host: localhost ``` affected versions reconstruct the URL as `http://localhost@google.com`. Per [RFC 3986 §3.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1), the substring before `@` in the authority is `userinfo`, so re-parsing yields `username = "localhost"` and `hostname = "google.com"`, with an empty path: ```text request.url == "http://localhost@google.com" request.url.hostname == "google.com" request.url.path == "" ``` The root cause is that the path is concatenated directly after the host without a separating `/`, and without validating that it begins with one. Only the `Host` header was validated when constructing `request.url`; the path was not. This requires an ASGI server that forwards a request-target lacking a leading `/` into `scope["path"]`. ##### Impact Any application running an affected version that uses `request.url`, `request.url.netloc`, or `request.url.hostname` for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first. Note that this is less exploitable than [GHSA-86qp-5c8j-p5mr](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr): there, the poison is carried in the `Host` header, so the real path still routes to a valid endpoint while `request.url.path` lies. Here, the poison must be carried in the path itself, and that path (`@google.com`) does not match any registered route, so routing returns `404` and no endpoint handler runs. The exposure is limited to code that reads `request.url` before routing - notably middleware - or in 404/exception handlers. ##### Mitigation Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields `http://localhost/@&#8203;google.com` with `request.url.hostname == "localhost"`. #### Severity - CVSS Score: 3.7 / 10 (Low) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N` #### References - [https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3](https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3) - [https://github.com/Kludex/starlette](https://github.com/Kludex/starlette) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS [CVE-2026-54283](https://nvd.nist.gov/vuln/detail/CVE-2026-54283) / [GHSA-82w8-qh3p-5jfq](https://github.com/advisories/GHSA-82w8-qh3p-5jfq) <details> <summary>More information</summary> #### Details ##### Summary `request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply. ##### Details `request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded` the parser is constructed without them. It has no `max_fields` or `max_part_size` parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies. Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects: - **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as `f0=v&f1=v&...`) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request. - **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the `FormData`, forcing memory allocation proportional to the request body. The equivalent `multipart/form-data` request is correctly rejected with `400 Too many fields` / `400 Field exceeded maximum size`. ##### Impact This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call `request.form()` on `application/x-www-form-urlencoded` requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop. ##### Mitigation Upgrade to a patched version, which forwards `max_fields` and `max_part_size` to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match `multipart/form-data` (`max_fields=1000`, `max_part_size=1MB`) and can be customized via `request.form(max_fields=..., max_part_size=...)`. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq](https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq) - [https://github.com/Kludex/starlette](https://github.com/Kludex/starlette) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-82w8-qh3p-5jfq) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>Kludex/starlette (starlette)</summary> ### [`v1.3.1`](https://github.com/Kludex/starlette/releases/tag/1.3.1): Version 1.3.1 [Compare Source](https://github.com/Kludex/starlette/compare/1.3.0...1.3.1) #### What's Changed - Use `StarletteDeprecationWarning` instead of `DeprecationWarning` by [@&#8203;Kludex](https://github.com/Kludex) in [#&#8203;3119](https://github.com/Kludex/starlette/pull/3119) - Enforce `max_fields` and `max_part_size` in `FormParser` by [@&#8203;Kludex](https://github.com/Kludex) in [#&#8203;3329](https://github.com/Kludex/starlette/pull/3329) - Enforce `FormParser` limits in parser callbacks by [@&#8203;Kludex](https://github.com/Kludex) in [#&#8203;3331](https://github.com/Kludex/starlette/pull/3331) **Full Changelog**: <https://github.com/Kludex/starlette/compare/1.3.0...1.3.1> ### [`v1.3.0`](https://github.com/Kludex/starlette/releases/tag/1.3.0): Version 1.3.0 [Compare Source](https://github.com/Kludex/starlette/compare/1.2.1...1.3.0) #### What's Changed - Clamp oversized suffix ranges in `FileResponse` by [@&#8203;jiyujie2006](https://github.com/jiyujie2006) in [#&#8203;3307](https://github.com/Kludex/starlette/pull/3307) - Catch `OSError` alongside `MultiPartException` when closing temp files by [@&#8203;N3XT3R1337](https://github.com/N3XT3R1337) in [#&#8203;3191](https://github.com/Kludex/starlette/pull/3191) - Add `httpx2` to the `full` extra by [@&#8203;Kludex](https://github.com/Kludex) in [#&#8203;3323](https://github.com/Kludex/starlette/pull/3323) - Adjust testclient typing and warnings by [@&#8203;waketzheng](https://github.com/waketzheng) in [#&#8203;3322](https://github.com/Kludex/starlette/pull/3322) - Fix IndexError in URL.replace() on a URL with no authority by [@&#8203;LeSingh1](https://github.com/LeSingh1) in [#&#8203;3317](https://github.com/Kludex/starlette/pull/3317) - Annotate URLPath protocol parameter with Literal by [@&#8203;Chang-LeHung](https://github.com/Chang-LeHung) in [#&#8203;3285](https://github.com/Kludex/starlette/pull/3285) - avoid collapsing exception groups from user code by [@&#8203;graingert](https://github.com/graingert) in [#&#8203;2830](https://github.com/Kludex/starlette/pull/2830) - Use `removeprefix` to strip weak ETag indicator in `is_not_modified` by [@&#8203;gnosyslambda](https://github.com/gnosyslambda) in [#&#8203;3193](https://github.com/Kludex/starlette/pull/3193) - Build `request.url` from structured components by [@&#8203;Kludex](https://github.com/Kludex) in [#&#8203;3326](https://github.com/Kludex/starlette/pull/3326) #### New Contributors - [@&#8203;jiyujie2006](https://github.com/jiyujie2006) made their first contribution in [#&#8203;3307](https://github.com/Kludex/starlette/pull/3307) - [@&#8203;N3XT3R1337](https://github.com/N3XT3R1337) made their first contribution in [#&#8203;3191](https://github.com/Kludex/starlette/pull/3191) - [@&#8203;leestana01](https://github.com/leestana01) made their first contribution in [#&#8203;3319](https://github.com/Kludex/starlette/pull/3319) - [@&#8203;LeSingh1](https://github.com/LeSingh1) made their first contribution in [#&#8203;3317](https://github.com/Kludex/starlette/pull/3317) - [@&#8203;EmmanuelNiyonshuti](https://github.com/EmmanuelNiyonshuti) made their first contribution in [#&#8203;3204](https://github.com/Kludex/starlette/pull/3204) - [@&#8203;Chang-LeHung](https://github.com/Chang-LeHung) made their first contribution in [#&#8203;3285](https://github.com/Kludex/starlette/pull/3285) - [@&#8203;gnosyslambda](https://github.com/gnosyslambda) made their first contribution in [#&#8203;3193](https://github.com/Kludex/starlette/pull/3193) **Full Changelog**: <https://github.com/Kludex/starlette/compare/1.2.1...1.3.0> ### [`v1.2.1`](https://github.com/Kludex/starlette/releases/tag/1.2.1): Version 1.2.1 [Compare Source](https://github.com/Kludex/starlette/compare/1.2.0...1.2.1) #### What's Changed - Use `httpx2` for type checking in the `testclient` module by [@&#8203;leifwar](https://github.com/leifwar) in [#&#8203;3304](https://github.com/Kludex/starlette/pull/3304) - Add assert error for requires() when request param is not Request type by [@&#8203;KeeganOP](https://github.com/KeeganOP) in [#&#8203;3298](https://github.com/Kludex/starlette/pull/3298) #### New Contributors - [@&#8203;leifwar](https://github.com/leifwar) made their first contribution in [#&#8203;3304](https://github.com/Kludex/starlette/pull/3304) - [@&#8203;diskeu](https://github.com/diskeu) made their first contribution in [#&#8203;3243](https://github.com/Kludex/starlette/pull/3243) - [@&#8203;KeeganOP](https://github.com/KeeganOP) made their first contribution in [#&#8203;3298](https://github.com/Kludex/starlette/pull/3298) **Full Changelog**: <https://github.com/Kludex/starlette/compare/1.2.0...1.2.1> ### [`v1.2.0`](https://github.com/Kludex/starlette/releases/tag/1.2.0): Version 1.2.0 [Compare Source](https://github.com/Kludex/starlette/compare/1.1.0...1.2.0) #### What's Changed - Support httpx2 in the test client by [@&#8203;Kludex](https://github.com/Kludex) in [#&#8203;3291](https://github.com/Kludex/starlette/pull/3291) **Full Changelog**: <https://github.com/Kludex/starlette/compare/1.1.0...1.2.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODYuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Ni41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovate added 1 commit 2026-06-22 15:55:01 +00:00
renovate force-pushed renovate/pypi-starlette-vulnerability from 9102f3e669 to 4395b35320 2026-06-24 15:48:59 +00:00 Compare
renovate force-pushed renovate/pypi-starlette-vulnerability from 4395b35320 to 0b46c8edbf 2026-06-25 06:36:23 +00:00 Compare
irl merged commit 0b46c8edbf into main 2026-06-25 06:43:07 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
bug

Something is not working

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
help wanted

Need some help

  
invalid

Something is wrong

  
question

More information is needed

  
wontfix

This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: sr2/cloud-api#32
No description provided.
Delete branch "renovate/pypi-starlette-vulnerability"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?