CVE-2024-52581: Litestar ASGI Framework DoS Vulnerability

CVE-2024-52581 Overview

CVE-2024-52581 is a denial of service vulnerability in Litestar, an Asynchronous Server Gateway Interface (ASGI) framework for Python. Versions prior to 2.13.0 ship a multipart form parser that expects the entire request body as a single byte string and enforces no default limit on request body size. An unauthenticated attacker can submit large files wrapped in a multipart/form-data request to trigger excessive memory consumption on the server. The parser is vulnerable by design because both its public method signature and implementation require the full body in memory. This issue echoes a prior regression tracked as CVE-2023-25578. A patch is available in Litestar 2.13.0.

Critical Impact
Unauthenticated attackers can exhaust server memory by uploading arbitrarily large multipart payloads, causing application crashes and service outages.

Affected Products

Litestar versions prior to 2.13.0
Python ASGI applications using the built-in litestar._multipart parser
Endpoints accepting multipart/form-data requests without external size enforcement

Discovery Timeline

2024-11-20 - CVE-2024-52581 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52581

Vulnerability Analysis

The defect resides in the multipart form parser implemented in litestar/_multipart.py. The parser's public method signature requires the complete request body to be supplied as a single byte string before parsing begins. This design forces the ASGI server to buffer the entire upload in memory before Litestar can process it. Litestar applies no default upper bound on body size, so attackers control the allocation size directly through the Content-Length header or chunked transfer body. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. Limiting only the number of multipart parts does not address the issue, because a single oversized part still drives memory exhaustion.

Root Cause

The root cause is architectural rather than a single bug. The parser cannot stream input incrementally and instead operates on a fully materialized bytes object. Combined with the absence of a default request_max_body_size, the framework accepts request bodies of arbitrary length.

Attack Vector

An attacker sends an HTTP POST or PUT request with Content-Type: multipart/form-data to any Litestar route that consumes form data. The body can be a single very large field or a single large file part. The ASGI worker buffers the entire payload, allocating proportional heap memory and triggering out-of-memory conditions that crash the process or starve co-resident workloads. No authentication is required when the target endpoint is publicly reachable.

The upstream fix in commit 53c1473b5ff7502816a9a339ffc90731bb0c2138 introduces enforced body size limits. Review the Litestar Security Advisory GHSA-gjcc-jvgw-wvwj and the Litestar Multipart Source for implementation details.

Detection Methods for CVE-2024-52581

Indicators of Compromise

Spikes in resident memory usage on Litestar worker processes correlated with inbound multipart/form-data requests.
HTTP requests with unusually large Content-Length headers or chunked uploads to form-handling endpoints.
ASGI workers terminated by the operating system out-of-memory killer or systemd oom-kill events.
Repeated upload requests from a single source address against the same endpoint within a short window.

Detection Strategies

Inspect reverse-proxy access logs for POST and PUT requests with Content-Length exceeding documented business limits.
Alert when Python worker resident set size (RSS) crosses a defined threshold during request handling.
Correlate application-level 5xx responses and worker restarts with concurrent multipart uploads.

Monitoring Recommendations

Export ASGI server and Linux cgroup memory metrics to a centralized observability platform.
Enable WAF or reverse-proxy logging of request body sizes and content types for form endpoints.
Track the Litestar package version across deployments using software composition analysis tooling.

How to Mitigate CVE-2024-52581

Immediate Actions Required

Upgrade Litestar to version 2.13.0 or later across all environments running affected applications.
Configure request_max_body_size on Litestar routes that accept uploads to enforce a per-request ceiling.
Apply request body size limits at the reverse proxy or ingress layer in front of Litestar workers.
Restart ASGI workers after upgrade to ensure no vulnerable processes remain resident.

Patch Information

The maintainers released the fix in Litestar 2.13.0 via commit 53c1473b5ff7502816a9a339ffc90731bb0c2138. Details are documented in the GitHub Security Advisory GHSA-gjcc-jvgw-wvwj and the related GHSA-p24m-863f-fm6q advisory.

Workarounds

Place an HTTP reverse proxy such as NGINX or HAProxy in front of Litestar and enforce client_max_body_size at the edge.
Restrict access to upload endpoints with authentication and network ACLs until upgrade is complete.
Disable or remove unused routes that consume multipart/form-data if they are not business-critical.

bash

# Configuration example
# Upgrade Litestar to the patched release
pip install --upgrade 'litestar>=2.13.0'

# NGINX edge mitigation: cap request body size at 10 MB
# Add inside the relevant server { } block
client_max_body_size 10m;