SUSE-SU-2026:22151-1

Vulnerability from csaf_suse - Published: 2026-06-17 08:36 - Updated: 2026-06-17 08:36
Summary
Security update for python-starlette
Severity
Important
Notes
Title of the patch: Security update for python-starlette
Description of the patch: This update for python-starlette fixes the following issues - CVE-2025-54121: denial-of-service when parsing a multi-part form with large files (bsc#1246855). - CVE-2025-62727: DoS via Range header merging (bsc#1252805). - CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassing path-based security checks (bsc#1266369).
Patchnames: SUSE-SLES-16.0-940
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-54121
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2025-62727
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2026-48710
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch —
Vendor Fix
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-starlette",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-starlette fixes the following issues\n\n- CVE-2025-54121: denial-of-service when parsing a multi-part form with large files (bsc#1246855).\n- CVE-2025-62727: DoS via Range header merging (bsc#1252805).\n- CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassing path-based security checks\n  (bsc#1266369).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-940",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22151-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22151-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622151-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22151-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026936.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246855",
        "url": "https://bugzilla.suse.com/1246855"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1252805",
        "url": "https://bugzilla.suse.com/1252805"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1266369",
        "url": "https://bugzilla.suse.com/1266369"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-54121 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-54121/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-62727 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-62727/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48710 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48710/"
      }
    ],
    "title": "Security update for python-starlette",
    "tracking": {
      "current_release_date": "2026-06-17T08:36:56Z",
      "generator": {
        "date": "2026-06-17T08:36:56Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22151-1",
      "initial_release_date": "2026-06-17T08:36:56Z",
      "revision_history": [
        {
          "date": "2026-06-17T08:36:56Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-starlette-0.41.3-160000.3.1.noarch",
                "product": {
                  "name": "python313-starlette-0.41.3-160000.3.1.noarch",
                  "product_id": "python313-starlette-0.41.3-160000.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-starlette-0.41.3-160000.3.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
        },
        "product_reference": "python313-starlette-0.41.3-160000.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-starlette-0.41.3-160000.3.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
        },
        "product_reference": "python313-starlette-0.41.3-160000.3.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-54121",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-54121"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47.1 and below, when parsing a multi-part form with large files (greater than the default max spool size) starlette will block the main thread to roll the file over to disk. This blocks the event thread which means the application can\u0027t accept new connections. The UploadFile code has a minor bug where instead of just checking for self._in_memory, the logic should also check if the additional bytes will cause a rollover. The vulnerability is fixed in version 0.47.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-54121",
          "url": "https://www.suse.com/security/cve/CVE-2025-54121"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246855 for CVE-2025-54121",
          "url": "https://bugzilla.suse.com/1246855"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T08:36:56Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-54121"
    },
    {
      "cve": "CVE-2025-62727",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-62727"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette\u0027s FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial-of-service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-62727",
          "url": "https://www.suse.com/security/cve/CVE-2025-62727"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1252805 for CVE-2025-62727",
          "url": "https://bugzilla.suse.com/1252805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T08:36:56Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-62727"
    },
    {
      "cve": "CVE-2026-48710",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48710"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 3.2 / RFC 3986 3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48710",
          "url": "https://www.suse.com/security/cve/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266369 for CVE-2026-48710",
          "url": "https://bugzilla.suse.com/1266369"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:python313-starlette-0.41.3-160000.3.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:python313-starlette-0.41.3-160000.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-17T08:36:56Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48710"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.