Complete RC6 supply chain gates

2026-07-18 04:15:59 +02:00
parent 944269c25b
commit 027e4b078b
25 changed files with 3915 additions and 52 deletions
@@ -0,0 +1,33 @@
+{
+  "review_by": "2026-08-31",
+  "package": "starlette",
+  "constraint": "FastAPI 0.139.2 requires Starlette below 0.53; patched Starlette releases start at 1.0.1 or later.",
+  "compensating_controls": [
+    "GeoIntel rejects missing or ambiguous Host headers and request targets before request.url is accessed.",
+    "Application code logs the raw ASGI path and does not use request.url for authorization or routing.",
+    "application/x-www-form-urlencoded is rejected; supported uploads use bounded multipart requests behind nginx.",
+    "The release image is Linux, no HTTPEndpoint route class is used, and the Windows StaticFiles advisory is not applicable."
+  ],
+  "advisories": [
+    {
+      "id": "PYSEC-2026-161",
+      "reason": "Host/path ambiguity is rejected at the outer request middleware and request.url is not a security boundary."
+    },
+    {
+      "id": "PYSEC-2026-248",
+      "reason": "Non-slash request paths and ambiguous Host values are rejected before URL reconstruction."
+    },
+    {
+      "id": "PYSEC-2026-249",
+      "reason": "GeoIntel rejects application/x-www-form-urlencoded before Starlette form parsing."
+    },
+    {
+      "id": "PYSEC-2026-2280",
+      "reason": "GeoIntel registers FastAPI APIRouter functions and has no Starlette HTTPEndpoint routes."
+    },
+    {
+      "id": "PYSEC-2026-2281",
+      "reason": "The supported all-in-one production runtime is Linux; the advisory affects Windows StaticFiles."
+    }
+  ]
+}