Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kludex/starlette
main @ de970d7
6
Fixes
3
CVEs
CRITICAL
Peak severity
66.7%
Coverage
Highlights
Denial of Service: 3 prior fixes. Scrutinize any change in this area.
starlette/datastructures.py: most-fixed (3 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SSRF: Insecure URL reconstruction and lack of Host header validation allow attackers to inject path parameters or spoof host headers (CVE-2026-48710), bypassing security restrictions based on the parsed request URL.
Denial of Service: Resource exhaustion and file descriptor leaks can occur during multipart form parsing if SpooledTemporaryFile handles are not properly closed on exceptions, or if form field and file handling remains unbounded (CVE-2023-30798).
Reflected XSS: Failing to enable autoescaping by default in template engines like Jinja2 leaves downstream applications highly vulnerable to cross-site scripting attacks via unescaped user inputs.