PT-2025-44209 · Starlette+1 · Starlette+1

Published 2025-10-28 · Updated 2026-02-10 · CVE-2025-62727

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Starlette versions 0.39.0 through 0.49.0

Description Starlette is a lightweight ASGI framework/toolkit. An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial-of-service for endpoints serving files, such as StaticFiles or any use of FileResponse. The parsing loop of FileResponse. parse range header() uses a regular expression that is vulnerable to denial of service due to its O(n^2) complexity. A crafted Range header can maximize this complexity. The merge loop processes each input range by scanning the entire result list, resulting in quadratic behavior with many disjoint ranges. This affects any Starlette application that uses starlette.staticfiles.StaticFiles or direct starlette.responses.FileResponse responses.

Recommendations Versions prior to 0.49.1 are affected.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-407

Related Identifiers

CVE-2025-62727

ECHO-FC38-DA22-1AFB

GHSA-7F5H-V6XP-FCQ8

OPENSUSE-SU-2025:15696-1

OPENSUSE-SU-2026:10109-1

Affected Products

Debian

Starlette

References · 22

• 🔥 https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62727.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15696-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62727 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-62727 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62727 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-62727 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-62727 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7f5h-v6xp-fcq8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62727 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10109-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-62727 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62727 · Vendor Advisory
• https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5 · Note
• https://github.com/Kludex/starlette · Note