CVE-2025-62727 - CVE House
Back to Database
Status published High CVE-2025-62727

Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

Vulnerability Description

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62727

Credits & Attribution

No credits recorded in the NVD database.

References

More from Kludex

View All →
CVE-2024-53981
python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary
High 7.5
CVE-2024-24762
python-multipart vulnerable to content-type header Regular expression Denial of Service
High 7.5

Affected Vendor

Affected Software

starlette
Vulnerable Versions:
>= 0.39.0, < 0.49.1

Timeline

Official Publish: October 28th, 2025
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-407

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.