Allocation of Resources Without Limits or Throttling in starlette - CVE-2025-54121
Published: September 26, 2025 / Updated: May 22, 2026
Vulnerability identifier: #VU116147
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-54121
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. A remote attacker can the vulnerability and perform a denial of service (DoS) attack.
Affected software
starlette
Debian Linux
openSUSE Leap
Maximo Application Suite - Visual Inspection Component
Maximo Application Suite Ai Service
Astronomer with IBM
starlette (Debian package)
python311-starlette
App Connect Enterprise Certified Container
Debian Linux
openSUSE Leap
Maximo Application Suite - Visual Inspection Component
Maximo Application Suite Ai Service
Astronomer with IBM
starlette (Debian package)
python311-starlette
App Connect Enterprise Certified Container
How to mitigate CVE-2025-54121
Install updates from vendor's website.
starlette - update to 0.47.2
Maximo Application Suite - Visual Inspection Component - addressed in versions 8.9.16, 9.0.13
Maximo Application Suite Ai Service - update to 9.1.3
starlette (Debian package) - addressed in versions 0.26.1-1+deb12u1, 0.46.1-3+deb13u2
python311-starlette - update to 0.35.1-150600.3.6.1
Astronomer with IBM - update to 1.1.0
App Connect Enterprise Certified Container - addressed in versions 12.0.18, 12.18.0
Maximo Application Suite - Visual Inspection Component - addressed in versions 8.9.16, 9.0.13
Maximo Application Suite Ai Service - update to 9.1.3
starlette (Debian package) - addressed in versions 0.26.1-1+deb12u1, 0.46.1-3+deb13u2
python311-starlette - update to 0.35.1-150600.3.6.1
Astronomer with IBM - update to 1.1.0
App Connect Enterprise Certified Container - addressed in versions 12.0.18, 12.18.0
External References
- https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14
- https://github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1
- https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403
- https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73
- https://github.com/Kludex/starlette/security/advisories/GHSA-2c2j-9gv5-cj73
Related Security Bulletins
- Allocation of resources without limits or throttling in Starlette
- Allocation of resources without limits or throttling in IBM Maximo AI Service
- SUSE update for python-starlette
- Astronomer with IBM update for Starlette
- IBM App Connect Enterprise Certified Container operands update for Starlette
- IBM Maximo Application Suite - Visual Inspection Component update for Starlette
- Debian update for starlette