title: MultipartParser DOS with too many fields or files in Starlette Framework
description: There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
collectionURL: https://pypi.org/project/starlette/
defaultStatus: unaffected
packageName: starlette
platforms: all
product: Starlette
repo: https://github.com/encode/starlette
vendor: Encode
versions:
lessThan: 0.25.0, status: affected, version: 0, versionType: python
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL