CVE-2025-62727

High CVSS: 7.5

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

Vendor

Product

CWE

CWE-407

Yayın Tarihi

2025-10-28 21:15:40

Güncelleme

2025-11-04 18:16:45

Source Identifier

security-advisories@github.com

KEV Date Added

Kategoriler

CWE-407 HIGH 2025

Referanslar

https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5 https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c https://github.com/Kludex/starlette/releases/tag/0.49.1 https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8 https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8