Listen to this Post
How the CVE Works
Starlette’s file upload handler fails to properly check if incoming data exceeds the spooled temporary file’s memory threshold before writing. When processing large multi-part forms, it blocks the main thread during disk rollover, stalling the event loop. This occurs because `_in_memory` only checks the current roll state, not whether the next write would trigger a rollover. The fix involves pre-emptively verifying the data size against the remaining buffer capacity.
DailyCVE Form
Platform: Starlette
Version: <1.37.2
Vulnerability: DoS via thread blocking
Severity: Low
Date: 2024-06-15
Prediction: Patch by 2024-07-10
What Undercode Say
Analytics:
curl -X POST -F "[email protected]" http://starlette-server/form
from starlette.requests import UploadFile if upload.size + len(data) > MAX_SPOOL: Fix check await roll_to_disk()
How Exploit
1. Send multi-part form with oversized file.
2. Trigger synchronous disk write.
3. Block event loop.
Protection from this CVE
- Update to Starlette >=1.37.2.
- Limit
max_spool_size. - Use async storage backends.
Impact
- Temporary service freeze.
- Low risk for modern storage.
- Tape systems affected more.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
