BaseFortify

Publication date: 2025-10-28

Last updated on: 2025-11-04

Assigner: GitHub, Inc.

Description

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-28

Last Modified

2025-11-04

Generated

2026-07-06

AI Q&A

2025-10-28

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62727

Affected Vendors & Products

Vendor	Product	Version / Range
kludex	starlette	0.49.0
kludex	starlette	0.49.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability in Starlette versions prior to 0.49.1 allows an unauthenticated attacker to send a specially crafted HTTP Range header that causes the FileResponse component to perform quadratic-time processing during Range parsing and merging. This excessive processing leads to high CPU usage per request, potentially causing denial-of-service conditions on endpoints serving files.

Impact Analysis

The vulnerability can lead to denial-of-service (DoS) attacks by exhausting CPU resources on servers running vulnerable versions of Starlette when handling file-serving endpoints. This can make the affected services unavailable to legitimate users.

Mitigation Strategies

Upgrade Starlette to version 0.49.1 or later, as this version contains the fix for the vulnerability. Until the upgrade can be applied, consider restricting or disabling endpoints serving files using FileResponse or StaticFiles to prevent exploitation.

Hi! I’m here to help you understand CVE-2025-62727. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70