CVE-2025-54121 in starlette
Summary
by MITRE • 07/21/2025
Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can't accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/10/2025
The vulnerability identified as CVE-2025-54121 affects the Starlette framework, a lightweight asynchronous web framework for Python that operates on the ASGI interface. This issue specifically manifests in versions 0.47.1 and earlier, where the framework exhibits problematic behavior during the processing of large multi-part form data submissions. The core problem lies in how Starlette handles file uploads that exceed the default maximum spool size, creating a critical performance and availability concern for applications relying on this framework.
The technical flaw resides in the UploadFile implementation's file rollover logic within the multipart form parsing mechanism. When processing large file uploads, the framework attempts to manage memory usage by spooling data to disk when size limits are exceeded. However, the current implementation contains a logical error where it only checks the self._in_memory flag without properly evaluating whether additional bytes will trigger the rollover condition. This oversight causes the main execution thread to become blocked during the file spooling operation, effectively preventing the asynchronous event loop from processing new incoming connections.
The operational impact of this vulnerability is significant as it creates a denial of service condition for web applications. When the main thread becomes blocked during file rollover operations, the entire event-driven processing capability of the Starlette framework is compromised. This means that while one large file upload is being processed, the application cannot accept new connections or handle other requests, leading to service degradation or complete unavailability of the web service. The blocking behavior fundamentally contradicts the asynchronous design principles that Starlette is built upon, creating a bottleneck that affects overall application throughput and responsiveness.
This vulnerability aligns with CWE-400, which addresses uncontrolled resource consumption, and specifically relates to improper handling of resource management in asynchronous environments. The issue also maps to ATT&CK technique T1499.004, which involves network disruption through resource exhaustion, as the blocking behavior effectively exhausts the application's ability to handle concurrent connections. Additionally, the problem demonstrates characteristics of CWE-674, which deals with uncontrolled recursion or excessive resource consumption in a single thread, and CWE-121, concerning stack-based buffer overflow conditions that can occur in improper resource management scenarios.
The fix implemented in version 0.47.2 addresses the core logic error by properly incorporating checks for both the in-memory status and the potential rollover conditions when processing file uploads. This update ensures that the framework maintains its asynchronous behavior even when handling large file transfers, preventing the blocking of the main execution thread. Organizations using Starlette framework versions 0.47.1 or earlier should immediately upgrade to version 0.47.2 or later to mitigate this vulnerability and restore proper concurrent connection handling capabilities. The patch represents a critical security update that restores the framework's intended asynchronous processing characteristics while maintaining proper resource management during large file operations.