StackPrism

PyPI package

starlette vulnerabilities by version

The latest release, 1.8.0 (Oct 13, 2026), has no known vulnerabilities. 2 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 10 advisories for starlette; the newest was published on Jun 15, 2026.

PyPI (opens in a new tab) describes it as “The little ASGI library that shines.”

Latest release
1.8.0
Oct 13, 2026, no known vulnerabilities
Downloads last week
145.4M
All versions, from pypistats.org
Advisories on OSV.dev
10
Newest Jun 15, 2026
Licence
BSD-3-Clause

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
1.8.0latestOct 13, 2026No known vulnerabilities
1.7.0Sep 23, 2026No known vulnerabilities
1.6.0Aug 8, 2026No known vulnerabilities
1.5.1Aug 8, 2026No known vulnerabilities
1.5.0Aug 8, 2026No known vulnerabilities
1.4.1Aug 5, 2026No known vulnerabilities
1.4.0Aug 5, 2026No known vulnerabilities
1.3.1Jun 12, 2026No known vulnerabilities
1.3.0Jun 11, 20261 known vulnerability, worst rated critical
1.2.1May 31, 20262 known vulnerabilities, worst rated critical

Release lines

The newest release of each minor line, from the registry. starlette doesn’t publish support dates we can check.

LineNewest releaseReleased
1.81.8.0Oct 13, 2026
1.71.7.0Sep 23, 2026
1.61.6.0Aug 8, 2026
1.51.5.1Aug 8, 2026
1.41.4.1Aug 5, 2026
1.31.3.1Jun 12, 2026

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-54283 on OSV.dev (opens in a new tab)GHSA-82w8-qh3p-5jfq

    Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

    Affects >= 0.4.1, < 1.3.1. Published Jun 15, 2026.

  2. LowCVE-2026-54282 on OSV.dev (opens in a new tab)GHSA-jp82-jpqv-5vv3

    Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

    Affects < 1.3.0. Published Jun 15, 2026.

  3. CriticalCVE-2026-48818 on OSV.dev (opens in a new tab)GHSA-wqp7-x3pw-xc5r

    Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

    Affects < 1.1.0. Published Jun 15, 2026.

  4. WarningCVE-2026-48817 on OSV.dev (opens in a new tab)GHSA-x746-7m8f-x49c

    Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

    Affects < 1.1.0. Published Jun 15, 2026.

  5. CriticalCVE-2026-48710 on OSV.dev (opens in a new tab)GHSA-86qp-5c8j-p5mrExploited in the wild (CISA)

    Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

    Affects < 1.0.1. Published Jun 4, 2026.

All 10 advisories are on OSV.dev (opens in a new tab).

Which starlette do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for starlette, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.