-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 25 Jul 2026 00:12:35 -0300
Source: starlette
Architecture: source
Version: 0.46.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Piotr Ożarowski <piotr@debian.org>
Changed-By: Matheus Polkorny <mpolkorny@gmail.com>
Closes: 1140631 1140632
Changes:
 starlette (0.46.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Team upload.
   * d/patches: (Closes: #1140631, #1140632)
     - CVE-2026-48817: Import and backport upstream patch
       (Prevent unintended HTTPEndpoint method dispatch)
     - CVE-2026-54282: Import upstream patch
       (Validate request paths to prevent host confusion)
     - CVE-2026-54283: Import and backport upstream patch
       (Enforce max_fields and max_part_size limits)
Checksums-Sha1:
 b7e6c0043c772b167aa8bf064671ab824a466ef8 2495 starlette_0.46.1-3+deb13u3.dsc
 9b40ecf58e5118bae9fc5b2c0f8f9cef1ade3971 2580102 starlette_0.46.1.orig.tar.gz
 59475e3e0bb41bacef51ff30fde64740a6c40f49 11612 starlette_0.46.1-3+deb13u3.debian.tar.xz
 7e277eee846fe6c73c4211c5120b75983597f08b 7044 starlette_0.46.1-3+deb13u3_source.buildinfo
Checksums-Sha256:
 f3016fa3bcbe6c77c89cadb56cb17970c64c0bf26e61c69f8800663ac6ada676 2495 starlette_0.46.1-3+deb13u3.dsc
 3c88d58ee4bd1bb807c0d1acb381838afc7752f9ddaec81bbe4383611d833230 2580102 starlette_0.46.1.orig.tar.gz
 72e28a6d618dab03df8131a7f4cc3ff85acb93a943fdd0d2c8f2466210ad61ce 11612 starlette_0.46.1-3+deb13u3.debian.tar.xz
 c449e6b55e3327729420b0e245ec1ee3ab896147c8daa3fb4df8b41bfcc72de7 7044 starlette_0.46.1-3+deb13u3_source.buildinfo
Files:
 448d612b7ce1ba18998dc4ac4adec5c6 2495 python optional starlette_0.46.1-3+deb13u3.dsc
 01d82f7d2cc4509628ee4a97e8618c5e 2580102 python optional starlette_0.46.1.orig.tar.gz
 890398fac1d34740965614e0dfa24cb0 11612 python optional starlette_0.46.1-3+deb13u3.debian.tar.xz
 1398cfd3d1f25dc86e21b2903a7b0359 7044 python optional starlette_0.46.1-3+deb13u3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEECgzx8d8+AINglLHJt4M9ggJ8mQsFAmqPHncACgkQt4M9ggJ8
mQuyOg/+LuW44Md7pJstBdzLTNsmRHeeWYS3RObWRuQv3uILJgnw6NYhvoKFpQpX
qchQoLOkonRyyH3Viy+o0xzRpH91GG92FzPmHcO+9z06MpBhZzyxZF/b/plAQ3Gb
KsbB0qjTAJ9byzPe7CwEbsusuxbCo1ORiuakAJVhIkQbDyiPdXA4XoAiQie7i/wi
9XLYxtsbbqMQDwQ9SX/85e12sPFCD/zz3UdjsBY6eKD3s0YsiPYC/ls9VJAgVIx2
uxm2DQU/PpqTE1KtL9h2Uvtpq6g26GUaFHoiAu5oKE672JRA6VIhTiWpOnltwQHE
KIJfGYupvXybPJggJut5NHCUeIv9i9jTwQgJSlnNZFeQuMjn2QcIGXU/3itige+D
9EQMnI/S6S5vrlXnm2chBKXyDf+WyO1vR8C0dQm70XkOWNPDRw01oSvxkDP9PGYC
JjiUEFPP06QQaurXBRMeaFz2OMLtyyNMEU+ii0+T9JDjn5AF1zqwz0ItGNH7bYN+
a+HxkzX8oKGWL9VbCRTNN4bwJw8cgks889Nn2PDg2nVlZfTC4LnCTd57QMD9GStl
yrmuffFboQ9nfVh4qRcgOgS0wKTxXi3BIaSj93smNK1hiYdM/uIs9rEoJdA1rt/h
1wc6Vx3MMaJ2iwoXnyinhyrkYYM+mwzheLB2F7c13gsadAHNEYA=
=EZLs
-----END PGP SIGNATURE-----