--- id: CVE-2025-62727 title: Starlette is a lightweight ASGI framework/toolkit summary: >- Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileRespo… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-407 vendor: starlette product: starlette affected: - 'starlette >= 0.39.0, < 0.49.1' patched: - starlette 0.49.1 published: '2025-10-28' updated: '2026-10-08' sourceUpdated: '2026-10-08T11:10:00.250' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62727' references: - url: >- https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5 label: security-advisories@github.com - url: >- https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c label: security-advisories@github.com - url: 'https://github.com/Kludex/starlette/releases/tag/0.49.1' label: security-advisories@github.com - url: >- https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8 label: security-advisories@github.com - url: >- https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8 label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62727' - url: 'https://github.com/Kludex/starlette' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62727.json - url: 'https://access.redhat.com/security/cve/CVE-2025-62727' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2406929' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-62727' - url: 'https://access.redhat.com/errata/RHSA-2025:23080' - url: 'https://access.redhat.com/errata/RHSA-2025:23078' - url: 'https://access.redhat.com/errata/RHSA-2026:3461' - url: 'https://access.redhat.com/errata/RHSA-2026:3462' - url: 'https://access.redhat.com/errata/RHSA-2025:23079' - url: 'https://access.redhat.com/errata/RHSA-2025:23131' - url: 'https://access.redhat.com/errata/RHSA-2025:23133' - url: 'https://access.redhat.com/errata/RHSA-2025:22759' - url: 'https://access.redhat.com/errata/RHSA-2025:23531' - url: 'https://access.redhat.com/errata/RHSA-2026:44696' - url: 'https://access.redhat.com/errata/RHSA-2026:22993' tags: - nvd - exploit-available - osv - pip - csaf - vex - red-hat epss: 0.008 epssPercentile: 0.56371 exploits: github: 1 githubRepos: - 'https://github.com/ch4n3-yoon/CVE-2025-62727-Demo' checkedAt: '2026-10-27T16:48:27.266Z' exploitAvailable: true aliases: - GHSA-7f5h-v6xp-fcq8 - PYSEC-2026-1942 ecosystem: pip ingestedAt: '2026-07-08T18:25:46.986Z' --- ## Overview Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2025-62727) Affected packages: - `starlette >= 0.39.0, < 0.49.1` Patched in: - `starlette 0.49.1` Source: https://osv.dev/vulnerability/GHSA-7f5h-v6xp-fcq8 ## Vendor advisories - **RHSA-2025:23080** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23080) - **RHSA-2025:23078** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23078) - **RHSA-2026:3461** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3461) - **RHSA-2026:3462** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:3462) - **RHSA-2025:23079** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23079) - **RHSA-2025:23131** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23131) - **RHSA-2025:23133** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23133) - **RHSA-2025:22759** · Red Hat · fixed in: Red Hat OpenShift AI 2.22 · released 2025-12-04 · [advisory](https://access.redhat.com/errata/RHSA-2025:22759) - **RHSA-2025:23531** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2025-12-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:23531) - **RHSA-2026:44696** · Red Hat · fixed in: Red Hat Satellite 6.17 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44696) - **RHSA-2026:22993** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22993) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI), Red Hat Satellite 6 · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI), OpenShift Lightspeed, Red Hat Satellite 6 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62727.json)