{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"starlette","platforms":["all"],"product":"Starlette","source":"CNA: VulnCheck","vendor":"Encode","versions":[{"lessThan":"0.25.0","status":"affected","version":"0","versionType":"python"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"starlette","product":"starlette","source":"OSV GHSA-74m5-2c7w-9w3x","vendor":"","versions":[{"status":"affected","version":"0.1.0","versionType":"PyPI"},{"status":"affected","version":"0.1.1","versionType":"PyPI"},{"status":"affected","version":"0.1.10","versionType":"PyPI"},{"status":"affected","version":"0.1.11","versionType":"PyPI"},{"status":"affected","version":"0.1.12","versionType":"PyPI"},{"status":"affected","version":"0.1.13","versionType":"PyPI"},{"status":"affected","version":"0.1.14","versionType":"PyPI"},{"status":"affected","version":"0.1.15","versionType":"PyPI"},{"status":"affected","version":"0.1.16","versionType":"PyPI"},{"status":"affected","version":"0.1.17","versionType":"PyPI"},{"status":"affected","version":"0.1.2","versionType":"PyPI"},{"status":"affected","version":"0.1.3","versionType":"PyPI"},{"status":"affected","version":"0.1.4","versionType":"PyPI"},{"status":"affected","version":"0.1.5","versionType":"PyPI"},{"status":"affected","version":"0.1.6","versionType":"PyPI"},{"status":"affected","version":"0.1.7","versionType":"PyPI"},{"status":"affected","version":"0.1.8","versionType":"PyPI"},{"status":"affected","version":"0.1.9","versionType":"PyPI"},{"status":"affected","version":"0.10.0","versionType":"PyPI"},{"status":"affected","version":"0.10.1","versionType":"PyPI"},{"status":"affected","version":"0.10.2","versionType":"PyPI"},{"status":"affected","version":"0.10.3","versionType":"PyPI"},{"status":"affected","version":"0.10.4","versionType":"PyPI"},{"status":"affected","version":"0.10.5","versionType":"PyPI"},{"status":"affected","version":"0.10.6","versionType":"PyPI"},{"status":"affected","version":"0.10.7","versionType":"PyPI"},{"status":"affected","version":"0.11.0","versionType":"PyPI"},{"status":"affected","version":"0.11.1","versionType":"PyPI"},{"status":"affected","version":"0.11.2","versionType":"PyPI"},{"status":"affected","version":"0.11.3","versionType":"PyPI"},{"status":"affected","version":"0.11.4","versionType":"PyPI"},{"status":"affected","version":"0.12.0","versionType":"PyPI"},{"status":"affected","version":"0.12.0b1","versionType":"PyPI"},{"status":"affected","version":"0.12.0b2","versionType":"PyPI"},{"status":"affected","version":"0.12.0b3","versionType":"PyPI"},{"status":"affected","version":"0.12.1","versionType":"PyPI"},{"status":"affected","version":"0.12.10","versionType":"PyPI"},{"status":"affected","version":"0.12.11","versionType":"PyPI"},{"status":"affected","version":"0.12.12","versionType":"PyPI"},{"status":"affected","version":"0.12.13","versionType":"PyPI"},{"status":"affected","version":"0.12.2","versionType":"PyPI"},{"status":"affected","version":"0.12.3","versionType":"PyPI"},{"status":"affected","version":"0.12.4","versionType":"PyPI"},{"status":"affected","version":"0.12.5","versionType":"PyPI"},{"status":"affected","version":"0.12.6","versionType":"PyPI"},{"status":"affected","version":"0.12.7","versionType":"PyPI"},{"status":"affected","version":"0.12.8","versionType":"PyPI"},{"status":"affected","version":"0.12.9","versionType":"PyPI"},{"status":"affected","version":"0.13.0","versionType":"PyPI"},{"status":"affected","version":"0.13.1","versionType":"PyPI"},{"status":"affected","version":"0.13.2","versionType":"PyPI"},{"status":"affected","version":"0.13.3","versionType":"PyPI"},{"status":"affected","version":"0.13.4","versionType":"PyPI"},{"status":"affected","version":"0.13.5","versionType":"PyPI"},{"status":"affected","version":"0.13.6","versionType":"PyPI"},{"status":"affected","version":"0.13.7","versionType":"PyPI"},{"status":"affected","version":"0.13.8","versionType":"PyPI"},{"status":"affected","version":"0.14.0","versionType":"PyPI"},{"status":"affected","version":"0.14.1","versionType":"PyPI"},{"status":"affected","version":"0.14.2","versionType":"PyPI"},{"status":"affected","version":"0.15.0","versionType":"PyPI"},{"status":"affected","version":"0.16.0","versionType":"PyPI"},{"status":"affected","version":"0.17.0","versionType":"PyPI"},{"status":"affected","version":"0.17.1","versionType":"PyPI"},{"status":"affected","version":"0.18.0","versionType":"PyPI"},{"status":"affected","version":"0.19.0","versionType":"PyPI"},{"status":"affected","version":"0.19.1","versionType":"PyPI"},{"status":"affected","version":"0.2.0","versionType":"PyPI"},{"status":"affected","version":"0.2.1","versionType":"PyPI"},{"status":"affected","version":"0.2.2","versionType":"PyPI"},{"status":"affected","version":"0.2.3","versionType":"PyPI"},{"status":"affected","version":"0.20.0","versionType":"PyPI"},{"status":"affected","version":"0.20.1","versionType":"PyPI"},{"status":"affected","version":"0.20.2","versionType":"PyPI"},{"status":"affected","version":"0.20.3","versionType":"PyPI"},{"status":"affected","version":"0.20.4","versionType":"PyPI"},{"status":"affected","version":"0.21.0","versionType":"PyPI"},{"status":"affected","version":"0.22.0","versionType":"PyPI"},{"status":"affected","version":"0.23.0","versionType":"PyPI"},{"status":"affected","version":"0.23.1","versionType":"PyPI"},{"status":"affected","version":"0.24.0","versionType":"PyPI"},{"status":"affected","version":"0.3.0","versionType":"PyPI"},{"status":"affected","version":"0.3.1","versionType":"PyPI"},{"status":"affected","version":"0.3.2","versionType":"PyPI"},{"status":"affected","version":"0.3.3","versionType":"PyPI"},{"status":"affected","version":"0.3.4","versionType":"PyPI"},{"status":"affected","version":"0.3.5","versionType":"PyPI"},{"status":"affected","version":"0.3.6","versionType":"PyPI"},{"status":"affected","version":"0.3.7","versionType":"PyPI"},{"status":"affected","version":"0.4.0","versionType":"PyPI"},{"status":"affected","version":"0.4.1","versionType":"PyPI"},{"status":"affected","version":"0.4.2","versionType":"PyPI"},{"status":"affected","version":"0.5.0","versionType":"PyPI"},{"status":"affected","version":"0.5.1","versionType":"PyPI"},{"status":"affected","version":"0.5.2","versionType":"PyPI"},{"status":"affected","version":"0.5.3","versionType":"PyPI"},{"status":"affected","version":"0.5.4","versionType":"PyPI"},{"status":"affected","version":"0.5.5","versionType":"PyPI"},{"status":"affected","version":"0.6.0","versionType":"PyPI"},{"status":"affected","version":"0.6.1","versionType":"PyPI"},{"status":"affected","version":"0.6.2","versionType":"PyPI"},{"status":"affected","version":"0.6.3","versionType":"PyPI"},{"status":"affected","version":"0.7.0","versionType":"PyPI"},{"status":"affected","version":"0.7.1","versionType":"PyPI"},{"status":"affected","version":"0.7.2","versionType":"PyPI"},{"status":"affected","version":"0.7.3","versionType":"PyPI"},{"status":"affected","version":"0.7.4","versionType":"PyPI"},{"status":"affected","version":"0.8.0","versionType":"PyPI"},{"status":"affected","version":"0.8.1","versionType":"PyPI"},{"status":"affected","version":"0.8.2","versionType":"PyPI"},{"status":"affected","version":"0.8.3","versionType":"PyPI"},{"status":"affected","version":"0.8.4","versionType":"PyPI"},{"status":"affected","version":"0.8.5","versionType":"PyPI"},{"status":"affected","version":"0.8.6","versionType":"PyPI"},{"status":"affected","version":"0.8.7","versionType":"PyPI"},{"status":"affected","version":"0.8.8","versionType":"PyPI"},{"status":"affected","version":"0.9.0","versionType":"PyPI"},{"status":"affected","version":"0.9.1","versionType":"PyPI"},{"status":"affected","version":"0.9.10","versionType":"PyPI"},{"status":"affected","version":"0.9.11","versionType":"PyPI"},{"status":"affected","version":"0.9.2","versionType":"PyPI"},{"status":"affected","version":"0.9.3","versionType":"PyPI"},{"status":"affected","version":"0.9.4","versionType":"PyPI"},{"status":"affected","version":"0.9.5","versionType":"PyPI"},{"status":"affected","version":"0.9.6","versionType":"PyPI"},{"status":"affected","version":"0.9.7","versionType":"PyPI"},{"status":"affected","version":"0.9.8","versionType":"PyPI"},{"status":"affected","version":"0.9.9","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"0.25.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2023-30798","cwes":["CWE-400"],"description":"There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.","epss":{"date":"2026-11-08","percentile":0.70605,"score":0.01299},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794146384129,"publishedAt":1682090867358,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/starlette-multipartparser-dos"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x"},{"source":"ADP: CVE","tags":["patch","x_transferred"],"url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/starlette-multipartparser-dos"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-74m5-2c7w-9w3x"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-74m5-2c7w-9w3x"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa"},{"kind":"fix","source":"ADP: CVE","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa"},{"kind":"fix","source":"OSV GHSA-74m5-2c7w-9w3x","text":"starlette (PyPI): OSV reports a fixed version 0.25.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-74m5-2c7w-9w3x"}],"revision":"abc4f1a4fdbdac635768b3d8fb7c7e3afc8a8554275d6df65f7721c65ed7e5ec","sources":[{"modifiedAt":1794146384129,"name":"CNA: VulnCheck","retrievedAt":1794146907961,"url":"https://www.cve.org/CVERecord?id=CVE-2023-30798"},{"modifiedAt":1783493576583,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146908579,"url":"https://osv.dev/vulnerability/GHSA-74m5-2c7w-9w3x"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150529199,"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-30798"}],"ssvc":{"assessedAt":1738701033208,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"MultipartParser DOS with too many fields or files in Starlette Framework","updatedAt":1794150529199}