CVE-2023-25578

Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This is a remote, potentially unauthenticated Denial of Service vulnerability. This vulnerability affects applications with a request handler that accepts a `Body(media_type=RequestEncodingType.MULTI_PART)`. The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop. Version 1.51.2 contains a patch for this issue.

• CWE-770
• CWE-770

• https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83Patch
• https://github.com/starlite-api/starlite/releases/tag/v1.51.2Release Notes
• https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6qExploit, Vendor Advisory
• https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83Patch
• https://github.com/starlite-api/starlite/releases/tag/v1.51.2Release Notes
• https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6qExploit, Vendor Advisory

Published

Feb 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25572react-admin is a frontend framework for building browser app…5.4
• CVE-2023-25573metersphere is an open source continuous testing platform. I…7.5
• CVE-2023-25574`jupyterhub-ltiauthenticator` is a JupyterHub authenticator …9.8
• CVE-2023-25575API Platform Core is the server component of API Platform: h…6.5
• CVE-2023-25576@fastify/multipart is a Fastify plugin to parse the multipar…7.5
• CVE-2023-25577Werkzeug is a comprehensive WSGI web application library. Pr…7.5
• CVE-2023-25579Nextcloud server is a self hosted home cloud product. In aff…7.5
• CVE-2023-2558The WPCS – WordPress Currency Switcher Professional plugin f…5.4
• CVE-2023-25581pac4j is a security framework for Java. `pac4j-core` prior t…9.2
• CVE-2023-25582Two OS command injection vulnerabilities exist in the zebra …7.2
• CVE-2023-25583Two OS command injection vulnerabilities exist in the zebra …7.2
• CVE-2023-25584An out-of-bounds read flaw was found in the parse_module fun…7.1