{"id":"CVE-2025-62727","title":"Starlette is a lightweight ASGI framework/toolkit","summary":"Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileRespo…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-407"],"vendor":"starlette","product":"starlette","affected":["starlette >= 0.39.0, < 0.49.1"],"patched":["starlette 0.49.1"],"published":"2025-10-28","updated":"2026-10-08","sourceUpdated":"2026-10-08T11:10:00.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62727","references":[{"url":"https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5","label":"security-advisories@github.com"},{"url":"https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c","label":"security-advisories@github.com"},{"url":"https://github.com/Kludex/starlette/releases/tag/0.49.1","label":"security-advisories@github.com"},{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8","label":"security-advisories@github.com"},{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62727"},{"url":"https://github.com/Kludex/starlette"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62727.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-62727"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406929"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62727"},{"url":"https://access.redhat.com/errata/RHSA-2025:23080"},{"url":"https://access.redhat.com/errata/RHSA-2025:23078"},{"url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"url":"https://access.redhat.com/errata/RHSA-2025:23079"},{"url":"https://access.redhat.com/errata/RHSA-2025:23131"},{"url":"https://access.redhat.com/errata/RHSA-2025:23133"},{"url":"https://access.redhat.com/errata/RHSA-2025:22759"},{"url":"https://access.redhat.com/errata/RHSA-2025:23531"},{"url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"url":"https://access.redhat.com/errata/RHSA-2026:22993"}],"tags":["nvd","exploit-available","osv","pip","csaf","vex","red-hat"],"epss":0.008,"epssPercentile":0.56371,"exploits":{"github":1,"githubRepos":["https://github.com/ch4n3-yoon/CVE-2025-62727-Demo"],"checkedAt":"2026-10-27T16:48:27.266Z"},"exploitAvailable":true,"aliases":["GHSA-7f5h-v6xp-fcq8","PYSEC-2026-1942"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:46.986Z","slug":"CVE-2025-62727","body":"## Overview\n\nStarlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-62727)\n\nAffected packages:\n\n- `starlette >= 0.39.0, < 0.49.1`\n\nPatched in:\n\n- `starlette 0.49.1`\n\nSource: https://osv.dev/vulnerability/GHSA-7f5h-v6xp-fcq8\n\n## Vendor advisories\n\n- **RHSA-2025:23080** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23080)\n- **RHSA-2025:23078** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23078)\n- **RHSA-2026:3461** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3461)\n- **RHSA-2026:3462** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3462)\n- **RHSA-2025:23079** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23079)\n- **RHSA-2025:23131** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23131)\n- **RHSA-2025:23133** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23133)\n- **RHSA-2025:22759** · Red Hat · fixed in: Red Hat OpenShift AI 2.22 · released 2025-12-04 · [advisory](https://access.redhat.com/errata/RHSA-2025:22759)\n- **RHSA-2025:23531** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2025-12-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:23531)\n- **RHSA-2026:44696** · Red Hat · fixed in: Red Hat Satellite 6.17 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44696)\n- **RHSA-2026:22993** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22993)\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI), Red Hat Satellite 6 · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI), OpenShift Lightspeed, Red Hat Satellite 6 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62727.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4853,"id":"CVE-2025-62727","ts":1788887211979,"field":"exploit_available","old":"false","new":"true"},{"seq":3736,"id":"CVE-2025-62727","ts":1788886328526,"field":"exploit_available","old":"true","new":"false"},{"seq":2581,"id":"CVE-2025-62727","ts":1788883009652,"field":"exploit_available","old":"false","new":"true"},{"seq":1610,"id":"CVE-2025-62727","ts":1788882409952,"field":"exploit_available","old":"true","new":"false"},{"seq":721,"id":"CVE-2025-62727","ts":1788881847181,"field":"exploit_available","old":"false","new":"true"}]}