CVE-2025-62727
published 2025-10-28CVE-2025-62727: Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.64%
46.0th percentile
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | starlette | < starlette 0.50.0-1 (forky) | starlette 0.50.0-1 (forky) |
| encode | starlette | >= 0 < 0.46.1-3+deb13u1 | 0.46.1-3+deb13u1 |
| encode | starlette | >= 0 < 0.50.0-1 | 0.50.0-1 |
| encode | starlette | >= 0.39.0 < 0.49.1 | 0.49.1 |
| kludex | starlette | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
starlette: Starlette DoS via Range header merging
vendor_redhat·2025-10-28·CVSS 7.5
CVE-2025-62727 [HIGH] CWE-407 starlette: Starlette DoS via Range header merging
starlette: Starlette DoS via Range header merging
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
A denial of service vulnerability has been discovered in the python Starlette framework. an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This induces CPU exhaustion per request, caus
Debian
CVE-2025-62727: starlette - Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 an...
vendor_debian·2025·CVSS 7.5
CVE-2025-62727 [HIGH] CVE-2025-62727: starlette - Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 an...
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.50.0-1)
sid: resolved (fixed in 0.50.0-1)
trixie: resolved (fixed in 0.46.1-3+deb13u1)
OSV
CVE-2025-62727: Starlette is a lightweight ASGI framework/toolkit
osv·2025-10-28·CVSS 7.5
CVE-2025-62727 [HIGH] CVE-2025-62727: Starlette is a lightweight ASGI framework/toolkit
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
GHSA
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
ghsa·2025-10-28
CVE-2025-62727 [HIGH] CWE-400 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
### Summary
An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).
### Details
Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.
```python
# starlette/responses.py
_RANGE_PATTERN = re.compile(r"(\d*)-(\d*)") # vulnerable to O(n^2) complexity ReDoS
class FileResponse(Response):
@staticmethod
def _parse_range_header(http_range: str, file_size: int) -> list[tuple[
OSV
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
osv·2025-10-28
CVE-2025-62727 [HIGH] Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
### Summary
An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).
### Details
Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.
```python
# starlette/responses.py
_RANGE_PATTERN = re.compile(r"(\d*)-(\d*)") # vulnerable to O(n^2) complexity ReDoS
class FileResponse(Response):
@staticmethod
def _parse_range_header(http_range: str, file_size: int) -> list[tuple[
No detection rules found.
No public exploits indexed.
https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3chttps://github.com/Kludex/starlette/releases/tag/0.49.1https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8
2025-10-28
Published