Kludex

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

In CISA KEValso in 9 other products

Python-Multipart has Arbitrary File Write via Non-Default Configuration

also in 2 other products

python-multipart vulnerable to content-type header Regular expression Denial of Service

also in 2 other products

Python-Multipart: Denial of Service via unbounded multipart part headers

also in 1 other product

Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

also in 2 other products

Kludex Python-multipart: Uncontrolled Resource Consumption

also in 1 other product

python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

also in 1 other product

Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

also in 1 other product

Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data

also in 2 other products

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

also in 2 other products

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

also in 2 other products

Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory

also in 1 other product

Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling

also in 1 other product