CVE-2025-62727

Published: Oct 28, 2025Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

Related CWEs

CWE-407

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (5)

https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5

Source: security-advisories@github.com

https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c

Source: security-advisories@github.com

https://github.com/Kludex/starlette/releases/tag/0.49.1

Source: security-advisories@github.com

https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8

Source: security-advisories@github.com

https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.