Fix security issues of version 0.56.1 for FastAPI

[ducminhgd]

Dear @Kludex ,

I'm using the latest version of FastAPI (0.139.2), and it requires Starlette>=0.46.0, the highest 0.* version is 0.52.1, and it contains some CVEs

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ idna             │ CVE-2026-45409 │ MEDIUM   │ fixed  │ 3.10              │ 3.15          │ python-idna: idna: Denial of Service via specially crafted   │
│                  │                │          │        │                   │               │ long inputs                                                  │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-45409                   │
├──────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ python-multipart │ CVE-2026-24486 │ HIGH     │        │ 0.0.20            │ 0.0.22        │ python-multipart: Python-Multipart: Arbitrary file write via │
│                  │                │          │        │                   │               │ path traversal vulnerability                                 │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-24486                   │
│                  ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-42561 │          │        │                   │ 0.0.27        │ python-multipart: python-multipart: Denial of Service via    │
│                  │                │          │        │                   │               │ excessive multipart part headers                             │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42561                   │
│                  ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-53539 │          │        │                   │ 0.0.30        │ python-multipart: Python-Multipart: Denial of Service via    │
│                  │                │          │        │                   │               │ crafted form-urlencoded bodies                               │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53539                   │
│                  ├────────────────┼──────────┤        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-40347 │ MEDIUM   │        │                   │ 0.0.26        │ python-multipart: Python-Multipart: Denial of Service via    │
│                  │                │          │        │                   │               │ crafted multipart/form-data requests                         │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-40347                   │
│                  ├────────────────┼──────────┤        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-53537 │ LOW      │        │                   │ 0.0.30        │ multipart: Python-Multipart: Information disclosure via      │
│                  │                │          │        │                   │               │ header parsing discrepancy                                   │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53537                   │
│                  ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-53538 │          │        │                   │               │ python-multipart: Python-Multipart: Information disclosure   │
│                  │                │          │        │                   │               │ due to parser differential in form data handling...          │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53538                   │
│                  ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-53540 │          │        │                   │ 0.0.31        │ python-multipart: Python-Multipart: Negative Content-Length  │
│                  │                │          │        │                   │               │ in parse_form buffers the entire body in memory...           │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53540                   │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Requesting FastAPI to upgrade dependencies is quite risk, it may cause breaking changes.

I checked out version 0.52.1 and cherry-pick fixed commits https://github.com/ducminhgd/starlette/tree/fix/0.52.1/security-issues and have an intention to create a fix version 0.52.2 or 0.53.0. Which ref should I create a pull request to? Please guide me to fix this.

Thank you.

---

EDITED:

Here is what I scanned from FastAPI 0.139.2

┌───────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│      Library      │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├───────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ starlette         │ CVE-2026-48818      │ HIGH     │        │ 0.52.1            │ 1.1.0         │ starlette: Starlette: SSRF and NTLM credential theft via UNC │
│                   │                     │          │        │                   │               │ paths in StaticFiles...                                      │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48818                   │
│                   ├─────────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-54283      │          │        │                   │ 1.3.1         │ starlette: Starlette: request.form() limits silently ignored │
│                   │                     │          │        │                   │               │ for application/x-www-form-urlencoded enable DoS             │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54283                   │
│                   ├─────────────────────┼──────────┤        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-48710      │ MEDIUM   │        │                   │ 1.0.1         │ starlette: Starlette: Security restriction bypass via        │
│                   │                     │          │        │                   │               │ malformed HTTP Host header                                   │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48710                   │
│                   ├─────────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-48817      │          │        │                   │ 1.1.0         │ starlette: Starlette: Information disclosure and unintended  │
│                   │                     │          │        │                   │               │ method execution via non-standard HTTP methods...            │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48817                   │
│                   ├─────────────────────┼──────────┤        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                   │ CVE-2026-54282      │ LOW      │        │                   │ 1.3.0         │ starlette: Starlette: Information disclosure due to improper │
│                   │                     │          │        │                   │               │ HTTP request path validation                                 │
│                   │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54282                   │
└───────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

[Kludex]

The fix is to bump to latest Starlette. From version 0 to 1 there were 0 breaking changes for non-deprecated features i.e. the only removed logic were things deprecated for more than 2 years.

[ducminhgd]

Hello, @Kludex .

Thank you for your quick response.

I meant just to fix the version 0.52.1 only, and I guess, it is not supported anymore. I would like to fix from 0.52.1 to 0.52.2 (or 0.53.0). May I request your help to create a branch for 0.52.2, and create a tag 0.52.2, and create a new version on PyPI?

[Kludex]

I understood what you said.

I'm not releasing security fixes on 0.x.