Bug 2382496 (CVE-2025-54121)

Summary:	CVE-2025-54121 starlette: Starlette denial-of-service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, alinfoot, anpicker, anthomas, aprice, bbrownin, bparees, dtrifiro, ehelms, ggainey, haoli, hasun, hkataria, jajackso, jcammara, jdobes, jfula, jkoehler, jmitchel, jneedle, jowilson, jsamir, juwatts, jwong, kaycoth, kegrant, koliveir, kshier, lphiri, mabashia, mhayden, mhulan, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pbraun, pcreech, ptisnovs, rbryant, rchan, sdoran, shvarugh, simaishi, smallamp, smcdonal, stcannon, syedriko, teagle, tfister, thavo, tmalecek, ttakamiy, weaton, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A denial of service flaw was found in the Starlette ASGI framework. This flaw allows a remote attacker to submit a specially crafted multi-part form with large files. This can exhaust the server's resources, which may block the main thread pool and lead to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-21 21:05:15 UTC

Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.