CVE-2024-47874: Starlette ASGI Framework DoS Vulnerability

CVE-2024-47874 Overview

CVE-2024-47874 is a high-severity Denial of Service (DoS) vulnerability affecting Starlette, a popular Asynchronous Server Gateway Interface (ASGI) framework/toolkit widely used in Python web development. Prior to version 0.40.0, Starlette improperly handles multipart/form-data parts that lack a filename attribute, treating them as text form fields and buffering them in byte strings with no size limit. This resource exhaustion flaw (CWE-770) allows attackers to upload arbitrarily large form fields, causing excessive memory allocations and copy operations that can render services unusable or trigger OOM (Out of Memory) termination.

Critical Impact

This vulnerability affects all applications built with Starlette or FastAPI that accept form requests, enabling attackers to exhaust server memory and cause complete service denial even when reverse proxy request size limits are in place.

Affected Products

• Starlette versions prior to 0.40.0
• FastAPI applications using vulnerable Starlette versions
• Any ASGI application built on Starlette that accepts multipart/form-data requests

Discovery Timeline

• 2024-10-15 - CVE-2024-47874 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-47874

Vulnerability Analysis

The vulnerability resides in Starlette's multipart form data parsing functionality within formparsers.py. When processing multipart/form-data requests, Starlette distinguishes between file uploads (which have a filename attribute) and text form fields (which do not). The critical flaw is that text form fields are buffered entirely in memory as byte strings without any size restrictions.

An attacker can exploit this by sending malformed multipart requests containing extremely large form fields without the filename attribute. Each such field is accumulated in memory, causing the server to perform excessive memory allocations and copy operations. The impact is two-fold: immediate performance degradation due to memory management overhead, and eventual memory exhaustion leading to service failure.

What makes this vulnerability particularly dangerous is that it can bypass conventional request size limits enforced by reverse proxies. Since the attack operates at the multipart parsing level, even applications behind properly configured load balancers remain vulnerable. Parallel exploitation requests can rapidly amplify the impact, rendering services practically unusable.

Root Cause

The root cause is improper allocation of resources without limits (CWE-770) in the MultipartPart class. The original implementation stored form field data as immutable bytes objects, which require creating new memory allocations and copying data for each append operation. This design, combined with the absence of size validation, creates both a memory exhaustion vector and amplifies the computational overhead of processing malicious requests.

Attack Vector

The attack vector is network-based with low complexity, requiring no authentication or user interaction. An attacker sends HTTP POST requests with Content-Type: multipart/form-data containing form fields without filename attributes but with extremely large content bodies. Multiple parallel requests can be used to accelerate memory exhaustion and maximize denial of service impact.

# Security patch in starlette/formparsers.py - Merge commit from fork
 class MultipartPart:
     content_disposition: bytes | None = None
     field_name: str = ""
-    data: bytes = b""
+    data: bytearray = field(default_factory=bytearray)
     file: UploadFile | None = None
     item_headers: list[tuple[bytes, bytes]] = field(default_factory=list)


-def _user_safe_decode(src: bytes, codec: str) -> str:
+def _user_safe_decode(src: bytes | bytearray, codec: str) -> str:
     try:
         return src.decode(codec)
     except (UnicodeDecodeError, LookupError):

Source: GitHub Commit Update

Detection Methods for CVE-2024-47874

Indicators of Compromise

• Abnormally high memory consumption on application servers running Starlette or FastAPI
• Multiple HTTP POST requests with multipart/form-data content type containing unusually large payloads
• OOM killer events in system logs targeting Python/ASGI processes
• Sudden degradation in application response times correlated with increased memory usage

Detection Strategies

• Monitor application memory usage patterns for sudden spikes during multipart form processing
• Implement request body size monitoring at the application layer, not just at the reverse proxy
• Deploy network-based anomaly detection for unusually large multipart/form-data POST requests
• Review application logs for timeout errors and memory-related exceptions during form handling

Monitoring Recommendations

• Configure alerting thresholds for memory utilization on Starlette/FastAPI application servers
• Implement rate limiting on endpoints that accept multipart form data submissions
• Enable detailed logging for multipart request processing to identify attack patterns
• Monitor process restart frequency as a potential indicator of OOM-related terminations

How to Mitigate CVE-2024-47874

Immediate Actions Required

• Upgrade Starlette to version 0.40.0 or later immediately
• Update FastAPI dependencies to pull in the patched Starlette version
• Implement request size limits at multiple layers including application-level validation
• Review and harden rate limiting configurations for form submission endpoints

Patch Information

The vulnerability is fixed in Starlette version 0.40.0. The patch modifies the MultipartPart class to use mutable bytearray instead of immutable bytes for storing form field data. This change significantly reduces memory allocation overhead during data accumulation. For detailed patch information, refer to the GitHub Security Advisory GHSA-f96h-pmfr-66vw and the security patch commit.

Workarounds

• Implement strict request body size limits at both reverse proxy and application levels
• Deploy memory resource limits (cgroups/container limits) to contain the impact of exploitation
• Consider implementing custom middleware to validate multipart form field sizes before processing
• Enable request timeout configurations to terminate long-running requests indicative of exploitation

# Configuration example - Update Starlette via pip
pip install --upgrade starlette>=0.40.0

# For FastAPI applications, update dependencies
pip install --upgrade fastapi

# Verify installed version
pip show starlette | grep Version