CVE-2023-30798CWE-400

MultipartParser DOS with too many fields or files in Starlette Framework

High · published April 21, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
70.2
In the wild
Unconfirmed
What it is

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01299 · 70.2th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-04-21T15:27Z
EPSS history
Timeline
  • 21 APR 15:27Z
    MultipartParser DOS with too many fields or files in Starlette Framework
    cvelistv5