StackRadar

CVE-2025-54121

Medium

Advisory

Published 21 Jul 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
104
of 17,781 indexed, latest versions
Container images
129
deployed by those charts
Fix available
1 of 1
affected package

Starlette has possible denial-of-service vector when parsing large files in multipart forms

Carried by container images the latest versions of 104 of 17,781 indexed charts deploy, on 129 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.13.6, 0.13.8, 0.14.1, 0.14.2+23 more0.47.2129
OSV records
GHSA-2c2j-9gv5-cj73
Also known as
PYSEC-2026-1941

Charts affected

104 by stars
ChartLatestAffected imagesRadar Score
syftopenmined0.9.52 of 6See more

syft openmined 0.9.5

2 of the 6 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
starlette@0.45.3
0.47.2
openmined/syft-seaweedfs:0.9.53a4144c0bb82
starlette@0.36.3
0.47.2

Open the chart page →

17,245
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
starlette@0.39.2
0.47.2

Open the chart page →

6,168
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
starlette@0.14.2
0.47.2

Open the chart page →

3,717
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
starlette@0.19.1
0.47.2

Open the chart page →

7,579
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
starlette@0.26.1
0.47.2

Open the chart page →

17,877
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
starlette@0.27.0
0.47.2

Open the chart page →

1,944
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
starlette@0.38.6
0.47.2

Open the chart page →

5,274
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
starlette@0.27.0
0.47.2

Open the chart page →

8,823
fastapi-microservice-appfast-api-microservice-app1.3.03 of 4See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

3 of the 4 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
omkara25/simple-microservice-app-order-service:v2.18327546c7aac
starlette@0.38.6
0.47.2
omkara25/simple-microservice-app-payment-service:v2afff40172b6b
starlette@0.38.6
0.47.2
omkara25/simple-microservice-app-user-service:v2d62cba548580
starlette@0.38.6
0.47.2

Open the chart page →

9,562
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
starlette@0.37.2
0.47.2

Open the chart page →

16,514
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
starlette@0.41.2
0.47.2

Open the chart page →

15,712
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
starlette@0.37.2
0.47.2

Open the chart page →

3,421
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
starlette@0.37.2
0.47.2

Open the chart page →

20,403
kubeseal-webguikubeseal-webgui6.0.41 of 2See more

kubeseal-webgui kubeseal-webgui 6.0.4

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/jaydee94/kubeseal-webgui/api:4.5.33cceb9462ae1
starlette@0.36.3
0.47.2

Open the chart page →

4,095
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
starlette@0.41.3
0.47.2

Open the chart page →

4,292
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
starlette@0.26.1
0.47.2
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
starlette@0.26.1
0.47.2
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
starlette@0.26.1
0.47.2

Open the chart page →

37,373
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
starlette@0.41.0
0.47.2

Open the chart page →

3,929
vuiseriohub1.0.62 of 3See more

vui seriohub 1.0.6

2 of the 3 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
starlette@0.45.3
0.47.2
dserio83/velero-watchdog:0.1.8d5deae589229
starlette@0.45.3
0.47.2

Open the chart page →

11,532
slo-reportingslo-reportingVerified publisher0.3.341 of 2See more

slo-reporting slo-reporting 0.3.34

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
starlette@0.41.3
0.47.2

Open the chart page →

2,928
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
starlette@0.46.2
0.47.2

Open the chart page →

12,907
akto-ai-guardrails-v2akto0.3.02 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

2 of the 6 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
aktosecurity/akto-agent-guard-anonymizer:1.1.4d4b100cbdc47
starlette@0.38.6
0.47.2
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
starlette@0.38.6
0.47.2

Open the chart page →

9,321
esphomealexmorbo-esphomeVerified publisher1.0.01 of 1See more

esphome alexmorbo-esphome 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
esphome/esphome:2024.12.2b2c6322700ac
starlette@0.39.2
0.47.2

Open the chart page →

6,324
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
starlette@0.46.2
0.47.2

Open the chart page →

40,238
flrepositorydbassist-iot-fl-repository1.1.01 of 2See more

flrepositorydb assist-iot-fl-repository 1.1.0

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
assistiot/fl_repository:latest0fce3ea719a5
starlette@0.19.1
0.47.2

Open the chart page →

4,367
trainingcollectorassist-iot-fl-training-collector1.1.01 of 1See more

trainingcollector assist-iot-fl-training-collector 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
assistiot/fl_training_collector:latest792715dd3084
starlette@0.16.0
0.47.2

Open the chart page →

1,719
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
starlette@0.27.0
0.47.2

Open the chart page →

18,277
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
starlette@0.17.1
0.47.2

Open the chart page →

1,790
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
starlette@0.46.2
0.47.2

Open the chart page →

26,996
ctk-walkthroughchaostoolkit-walkthrough0.1.03 of 3See more

ctk-walkthrough chaostoolkit-walkthrough 0.1.0

3 of the 3 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
chaostoolkit/back:latest734f3af86125
starlette@0.13.8
0.47.2
chaostoolkit/front:latest7f4a7eb9f7df
starlette@0.14.1
0.47.2
chaostoolkit/middle:latestb95ba4961cfc
starlette@0.14.1
0.47.2

Open the chart page →

5,557
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
starlette@0.37.2
0.47.2

Open the chart page →

4,042
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
starlette@0.46.2
0.47.2
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
starlette@0.41.2
0.47.2

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
starlette@0.41.2
0.47.2

Open the chart page →

11,335
design-cataloguedesign-catalogue0.1.01 of 2See more

design-catalogue design-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
starlette@0.14.2
0.47.2

Open the chart page →

2,770
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
0.47.2

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
0.47.2

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
starlette@0.41.0
0.47.2

Open the chart page →

19,224
codecovdoubanVerified publisher0.2.41 of 8See more

codecov douban 0.2.4

1 of the 8 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
starlette@0.36.2
0.47.2

Open the chart page →

24,917
helpdeskdoubanVerified publisher0.3.31 of 2See more

helpdesk douban 0.3.3

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
douz/helpdesk:latest4384103d0219
starlette@0.19.1
0.47.2

Open the chart page →

4,550
aerios-k8s-shimeclipse-aeriosVerified publisher1.0.01 of 1See more

aerios-k8s-shim eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
eclipseaerios/aerios-k8s-shim:v1.0.0d4ed3d8e5db4
starlette@0.38.4
0.47.2

Open the chart page →

1,434
hlo-data-aggregatoreclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-data-aggregator eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
eclipseaerios/hlo-data-aggregator:v3.0.0b433c2b9f5dc
starlette@0.36.3
0.47.2

Open the chart page →

1,643
hlo-deployment-engineeclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-deployment-engine eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
eclipseaerios/hlo-deployment-engine:v3.0.0d582d39208c7
starlette@0.35.1
0.47.2

Open the chart page →

1,653
hlo-fe-engineeclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-fe-engine eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
eclipseaerios/hlo-fe-engine:v3.0.08ed2df4ca692
starlette@0.36.3
0.47.2

Open the chart page →

1,643
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
starlette@0.20.4
0.47.2

Open the chart page →

4,085
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
starlette@0.20.4
0.47.2

Open the chart page →

3,892
forms-catalogueforms-catalogue0.1.01 of 2See more

forms-catalogue forms-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
starlette@0.14.2
0.47.2

Open the chart page →

2,188
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
starlette@0.37.2
0.47.2
clsen2024/gwangju_2-3:service-a-151b1d45961cd
starlette@0.37.2
0.47.2
clsen2024/gwangju_2-3:service-c-1efb1586c8299
starlette@0.37.2
0.47.2

Open the chart page →

6,491
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latestf9f34c8ed688
starlette@0.46.2
0.47.2

Open the chart page →

1,683
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
starlette@0.39.2
0.47.2

Open the chart page →

6,008
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
starlette@0.46.0
0.47.2

Open the chart page →

4,647
notediscoveryhelmforgeVerified publisher2.0.11 of 1See more

notediscovery helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2025-54121.

Container imageDigestPackageFixed in
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
starlette@0.27.0
0.47.2

Open the chart page →

1,241

Container images carrying it

129 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kubiyabot/sdk-py:v1.20.0f108f49570cc
starlette@0.39.2
0.47.2
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
starlette@0.41.0
0.47.2
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
starlette@0.37.2
0.47.2
1
ghcr.io/openrelik/openrelik-mediator:latest42efc445b19e
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-server:latestce1132261523
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
starlette@0.46.2
0.47.2
1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
starlette@0.46.2
0.47.2
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
starlette@0.17.1
0.47.2
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
0.47.2
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
starlette@0.27.0
0.47.2
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
starlette@0.41.3
0.47.2
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
starlette@0.46.2
0.47.2
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
starlette@0.41.3
0.47.2
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
0.47.2
1
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
starlette@0.13.6
0.47.2
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
starlette@0.14.2
0.47.2
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
starlette@0.14.2
0.47.2
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
0.47.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.