CVE-2025-62727

Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

HIGH 7.5EPSS 0.8%

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

Affected: Kludex · starlette
CVSS v3.1 GITHUB: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.80% chance of exploitation in the next 30 days, 56th percentile
Published: 2025-10-28
Updated: 2025-11-04

Proof-of-concept exploits (2)

advisories/GHSA-7f5h-v6xp-fcq8
ch4n3-yoon/CVE-2025-62727-Demo1★ · 2025-10-28

References

CVE Record
NVD entry

CVE-2025-62727

Proof-of-concept exploits (2)

References

Related