build(deps): update dependency starlette to v0.40.0 [security] (main)
Metadata
Current evaluation
Merged in #5119 as 9fa59f7c4, upgrading Starlette 0.38.5 to 0.40.0 to remediate CVE-2024-47874's multipart form-data denial-of-service vulnerability.
Resolution: closed resolved
Reason: PR canonical/snapcraft#5119 was approved and merged as commit 9fa59f7c4, applying the security dependency upgrade.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [starlette](https://redirect.github.com/encode/starlette) ([changelog](https://www.starlette.io/release-notes/)) | `==0.38.5` -> `==0.40.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-47874](https://redirect.github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw)
### Summary
Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette.
### PoC
```python
from starlette.applications import Starlette
from starlette.routing import Route
async def poc(request):
async with request.form():
pass
app = Starlette(routes=[
Route('/', poc, methods=["POST"]),
])
```
```sh
curl http://localhost:8000 -F 'big=</dev/urandom'
```
### Impact
This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.
---
### Release Notes
<details>
<summary>encode/starlette (starlette)</summary>
### [`v0.40.0`](https://redirect.github.com/encode/starlette/releases/tag/0.40.0): Version 0.40.0
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.39.2...0.40.0)
This release fixes a Denial of service (DoS) via `multipart/form-data` requests.
You can view the full security advisory:
[GHSA-f96h-pmfr-66vw](https://redirect.github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw)
#### Fixed
- Add `max_part_size` to `MultiPartParser` to limit the size of parts in `multipart/form-data`
requests [fd038f3](https://redirect.github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733).
### [`v0.39.2`](https://redirect.github.com/encode/starlette/releases/tag/0.39.2): Version 0.39.2
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.39.1...0.39.2)
##### Fixed
- Allow use of `request.url_for` when only "app" scope is available [#​2672](https://redirect.github.com/encode/starlette/pull/2672).
- Fix internal type hints to support `python-multipart==0.0.12` [#​2708](https://redirect.github.com/encode/starlette/pull/2708).
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.39.1...0.39.2
### [`v0.39.1`](https://redirect.github.com/encode/starlette/releases/tag/0.39.1): Version 0.39.1
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.39.0...0.39.1)
#### Fixed
- Avoid regex re-compilation in `responses.py` and `schemas.py` [#​2700](https://redirect.github.com/encode/starlette/pull/2700).
- Improve performance of `get_route_path` by removing regular expression usage [#​2701](https://redirect.github.com/encode/starlette/pull/2701).
- Consider `FileResponse.chunk_size` when handling multiple ranges [#​2703](https://redirect.github.com/encode/starlette/pull/2703).
- Use `token_hex` for generating multipart boundary strings [#​2702](https://redirect.github.com/encode/starlette/pull/2702).
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.39.0...0.39.1
### [`v0.39.0`](https://redirect.github.com/encode/starlette/releases/tag/0.39.0): Version 0.39.0
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.38.6...0.39.0)
#### Added
- Add support for HTTP Range to `FileResponse` [#​2697](https://redirect.github.com/encode/starlette/pull/2697)
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.38.6...0.39.0
### [`v0.38.6`](https://redirect.github.com/encode/starlette/releases/tag/0.38.6): Version 0.38.6
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.38.5...0.38.6)
#### Fixed
- Close unclosed `MemoryObjectReceiveStream` in `TestClient` [#​2693](https://redirect.github.com/encode/starlette/pull/2693).
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.38.5...0.38.6
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4xMjAuMSIsInVwZGF0ZWRJblZlciI6IjM4LjEyMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in #5119 as 9fa59f7c4, upgrading Starlette 0.38.5 to 0.40.0 to remediate CVE-2024-47874's multipart form-data denial-of-service vulnerability. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of Starlette 0.38.5 -> 0.40.0 fixing CVE-2024-47874 (multipart/form-data DoS) merged into main as commit 9fa59f7c4; backported via PR #5120. | |
| stealth/space-bunny-alpha | — | closed resolved | PR canonical/snapcraft#5119 was merged, upgrading Starlette from 0.38.5 to 0.40.0 to mitigate CVE-2024-47874, a multipart form-data denial-of-service vulnerability. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency update upgrading starlette to v0.40.0 to resolve CVE-2024-47874, a denial-of-service vulnerability in multipart/form-data parsing. Approved by two reviewers with passing CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading starlette from 0.38.5 to 0.40.0 to patch CVE-2024-47874, a multipart/form-data denial-of-service vulnerability. Successfully merged into main by Renovate bot. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/snapcraft#5120
(confidence 99%)
The same Starlette security update was merged into hotfix/8.4 as commit fceb8c169.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) | snapcraft | merged | Renovate security bump of Starlette 0.38.4 -> 0.40.0 (CVE-2024-47874 multipart DoS) merged into hotfix/8.4 as commit fceb8c169; the equivalent main PR #5119 landed as 9fa59f7c4. | |
| #1180 build(deps): update dependency starlette to v0.47.2 [security] (main) | craft-parts | merged | Renovate security bump of starlette 0.45.3 → 0.47.2 merged into main as commit 48f28aa7 (PR #1180), fixing CVE-2025-54121 (event-loop blocking on large multipart uploads). | |
| #1181 build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7) | craft-parts | merged | Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7). | |
| #742 build(deps): update deps with freeze-requirements.sh | rockcraft | merged | Merged PR #742 as 5d776281, upgrading Starlette 0.39.2 to 0.41.0 to address the CVE-2024-47874 denial-of-service vulnerability. | |
| #84 build(deps): bump starlette from 0.48.0 to 0.49.1 | debcraft | merged | Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability. | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4). | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. | |
| #2716 build(deps): add constraint for Starlette | charmcraft | merged | Merged into main via commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE. | |
| #376 build(deps): add constraint for Starlette | craft-store | merged | Merged #376 via ed08e00, adding a Starlette >=1.0.1 constraint to avoid versions affected by the BadHost CVE. | |
| #208 build(deps): bump starlette from 0.48.0 to 0.49.1 | craft-platforms | closed | Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current. |