-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 01 Aug 2026 01:27:26 +0200 Source: starlette Architecture: source Version: 0.26.1-1+deb12u2 Distribution: bookworm-security Urgency: medium Maintainer: Piotr Ożarowski <piotr@debian.org> Changed-By: Daniel Leidert <dleidert@debian.org> Closes: 1140631 1140632 Changes: starlette (0.26.1-1+deb12u2) bookworm-security; urgency=medium . * Non-maintainer upload by the Debian LTS team. * d/patches/CVE-2026-48817.patch: Add patch to fix CVE-2026-48817. - Fix a vulnerability where an HTTPEndpoint subclass is registered through Route() without an explicit methods argument, and the route does not constrain the method and every method reaches the endpoint. * d/patches/CVE-2026-54282.patch: Add patch to fix CVE-2026-54282. - Fix a vulnerability where the HTTP request path is not validated before being used to reconstruct request.url which can poison request.url.hostname and request.url.netloc (closes: #1140632). * d/patches/Add-max_part_size-parameter-to-MultiPartParser.patch, d/patches/CVE-2026-54283.patch: Add patches to fix CVE-2026-54283. - Fix that the max_fields and max_part_size limits for request.form() are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded (closes: #1140631). Checksums-Sha1: adf574515b4240fc85ed72b9fee205cb952dc674 2459 starlette_0.26.1-1+deb12u2.dsc 9bf0bab7443336e90e9d84c28eb1ca4d31740743 2751032 starlette_0.26.1.orig.tar.xz 80dbbe68c8bf7bfa36f5d58df9a2099116f14d31 12228 starlette_0.26.1-1+deb12u2.debian.tar.xz f617d84ae3676639ab4936b2121de6a289cc9344 8098 starlette_0.26.1-1+deb12u2_source.buildinfo Checksums-Sha256: 884729d2ed780efae8290058e3d964250913ec9f63c5484d397cda1bebabeac8 2459 starlette_0.26.1-1+deb12u2.dsc 3fc1d12068c8178a372cb98e3c2880a435bd2766e9635f965892110c9805c45e 2751032 starlette_0.26.1.orig.tar.xz 2d20d4ceca8949093f6456d706017500a943d411e163982314392631ce883ea7 12228 starlette_0.26.1-1+deb12u2.debian.tar.xz 0103503065e54fd98912e32eb32a88948513aefcad34059db25f432618265c37 8098 starlette_0.26.1-1+deb12u2_source.buildinfo Files: 6b274401ba53ee1b33fdd042f11b9d33 2459 python optional starlette_0.26.1-1+deb12u2.dsc 665888eef945eafe1a77f3174d946e3e 2751032 python optional starlette_0.26.1.orig.tar.xz 4ac7f397111a96e9078d28055ad53ae6 12228 python optional starlette_0.26.1-1+deb12u2.debian.tar.xz a61084dc366145e63a0ee1ddb3bbf13d 8098 python optional starlette_0.26.1-1+deb12u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmptYm0ACgkQS80FZ8KW 0F0EghAArr97Hi0OPABaWW+U/bHYbxdf/kTTP0EntdSaqP1Wf5GrfigCKdUp1BUU LNYt1uimO5lEEP02rZpsm/nfm03hj/4TCXBCpIbSCvRo+Bx10zS1MM+HHVqFWjei C+2ZkP0Pn+Z55++oSPdKj0CP4qifFvV9MMmR64dKCOMonTCrPuHpJ4MIufnlq/gP MLqXB6/Ye/UXQMlglUthcZSf24lV/oEZ8Or+feXowVp6NFekHegyPkGvn6uH3pnN RiQnzKA4bolZpJWBtNSGnIRwC95reHHoI7pmFW1m0QWVbHk3F6IWSLdJHftWA5Pt +gwu63cPXipnP5GpfegDdTPJvO851saWKeTiWeAI/KzH3/ruWqYpdMzG0x6lGEfM HccLbfuIPPm+CUYgBb5CZrkfo8KeDbKBvmgmxVJH0qidUg69S10ATfK+kpYoxFWJ njoTJFdi7rQs9Jp8S+UNr5aE8R+xiw8edVXiUkFJ1lspVlPC9C3WEFgbRL8+2HlR rIgRuLSoqy+2ChULN/JcFVheDe5SQi0Xs3a/UtNDeuafg/PGAjsmaK9qVYh9xh4M nc2Xh87XMV8ijTVvsM+CV6qby8vss5i1LtPMXRWJXbnM1sb/qWB2l3Qhc5X6Huyw QR7KACb+RnY0LYVqOotCga0VbDxn54J4ZZi3GUbgBbKs985aDKU= =cHug -----END PGP SIGNATURE-----
