CVE-2025-62727High· 7.5▾ MidnightPoC availableStarlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileRespo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
1 GitHub repo
Last analysed / modified upstream
0.6% → 0.8%
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
starlette >= 0.39.0, < 0.49.1Patched in:
starlette 0.49.1Source: https://osv.dev/vulnerability/GHSA-7f5h-v6xp-fcq8
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48710Medium· 6.5Starlette is a lightweight ASGI framework/toolkit
CVE-2026-48817Medium· 5.3Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
CVE-2026-54282Low· 3.7Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
CVE-2026-112894High· 7.5Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-96640High· 7.5pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)