Is starlette healthy, maintained, and safe?
Maintained, but watch it — starlette has real signals (drift, thin maintenance, or advisories) worth tracking.
The verdict
On the OSPulse health scale, starlette lands at 55/100 — medium risk, computed deterministically from live PyPI release history, and the OSV vulnerability database. Maintained, but watch it — starlette has real signals (drift, thin maintenance, or advisories) worth tracking.
Its most recent release shipped on 12 June 2026 — 46 days ago — so development is clearly active. Across 195 releases the cadence has been steady, which is a good sign of an ongoing maintenance rhythm. PyPI doesn't expose a reliable maintainer count, so bus-factor isn't scored here — treat maintenance depth as unknown rather than assumed.
OSV lists 20 known advisories for starlette, including 5 high. Review whether your version is in the affected range and whether a fixed release is available before depending on it. Each advisory is listed with its OSV/GHSA identifier below.
starlette is usable but carries real signals — pin versions, watch for new advisories, and keep a fallback in mind. This is a one-time snapshot of a single package — real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own requirements.txt through the free health check, or have OSPulse monitor your whole dependency tree continuously.
Evidence trail — deterministic, auditable
Known vulnerabilities (20)
Starlette has possible denial-of-service vector when parsing large files in multipart forms
MultipartParser denial of service with too many fields or files
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Starlette Denial of service (DoS) via multipart/form-data
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Starlette has Path Traversal vulnerability in StaticFiles
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause ex
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks
Starlette has possible denial-of-service vector when parsing large files in multipart forms
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Starlette Denial of service (DoS) via multipart/form-data
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attr
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to i
Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating
Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are e
Key facts
- Latest version
- v1.3.1
- Last release
- 12 June 2026 (46 days ago)
- Total releases
- 195
- First release
- 25 June 2018
- Package age
- 8.1 years
- Maintainers
- not exposed by PyPI
- Known advisories
- 20
- Confidence
- High
Frequently asked
Is starlette still maintained?
Yes — starlette released as recently as 12 June 2026 (46 days ago), so it is actively maintained.
Does starlette have known security vulnerabilities?
Yes — OSV lists 20 advisories for starlette. See the advisory list on this page for the OSV/GHSA identifiers.
Is starlette safe to use?
Maintained, but watch it — starlette has real signals (drift, thin maintenance, or advisories) worth tracking. OSPulse rates it 55/100 (medium risk) based on release recency, cadence and known vulnerabilities.
Other PyPI packages we've checked
starlette is one package. What about the other hundreds in your tree?
Paste your own requirements.txt into the free health check for an instant snapshot — or let OSPulse monitor your whole dependency tree continuously, before your CVE scanner wakes up.
Data from the PyPI registry & OSV.dev · snapshot generated 2026-07-27 · scores are deterministic and recomputed on each refresh.