CVE-2025-62727
Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse
Description
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
INFO
Published Date :
Oct. 28, 2025, 9:15 p.m.
Last Modified :
June 17, 2026, 9:52 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update Starlette to version 0.49.1.
- Apply security patches for Starlette.
Public PoC/Exploit Available at Github
CVE-2025-62727 has a 28 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-62727.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-62727 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-62727
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
A security-first CLI tool that scans codebases for hardcoded secrets and tracks remediation through a local SQLite database. Self-gating CI/CD pipeline with Trivy container scanning and Semgrep SAST. Built as a DevSecOps portfolio project demonstrating secure development practices and vulnerability management.
devsecops ci-cd cli container-security docker fastapi github-actions infrastructure-as-code portfolio-project python sast secret-scanning security security-automation semgrep sqlite trivy typer vulnerability-management
Python Dockerfile
None
Dockerfile Python HTML
Home assignment for Elsa DevOps position
Shell Dockerfile Python Go Template JavaScript
RetailStore es una plataforma de e-commerce
Dockerfile HTML TypeScript Python Go HCL Shell
CV Review Engine is an AI-powered resume optimisation tool that evaluates CVs against job descriptions to generate structured, data-driven feedback. The system combines natural language processing and retrieval-augmented generation (RAG) to assess alignment with role requirements, highlight missing skills
Python Dockerfile JavaScript HTML CSS HCL Shell
None
Dockerfile Python Go Template Makefile
A DevSecOps demo project — REST API with a full security pipeline
Python Dockerfile
None
Makefile Python
None
Dockerfile Procfile Python PLpgSQL Shell PowerShell JavaScript Batchfile TypeScript CSS
a lightweight Platform-as-a-Service (PaaS) that allows developers to deploy applications by simply pushing their code. It automatically builds, deploys, and exposes applications via a public URL.
Makefile Shell Dockerfile Python Mako HTML JavaScript TypeScript CSS YARA
地震・水害（建設業現場は自然災害リスク大）・ランサムウェア攻撃を想定したIT事業継続管理（ITSCM）基盤。各システムのRTO/RPO目標値管理・DRテスト結果記録・BCP発動手順のデジタル化・復旧状況の可視化ダッシュボードを提供する。
HTML Shell Python TypeScript JavaScript CSS Dockerfile Mako HCL
Secure automated backup for Windows with AES-256-GCM streaming encryption, 3-2-1 redundancy, circuit breaker, 7-year compliance retention, and real-time file watching. Built with Electron + React + FastAPI.
automation backup-tool data-protection desktop-app electron fastapi file-sync local-backup python react sqlite vite watchdog ssd-backup encryption aes-256-gcm
Python JavaScript HTML Batchfile CSS
a web app that simulates real production support workflows: incident intake, triage, SLA tracking, runbooks, RCA, and closure.
Python HTML TypeScript CSS Dockerfile
Python Precomputed Reachability demo with targeted CVE versions
Python
Claude Code plugin marketplace for LLM-based security vulnerability discovery, inspired by Seokchan Yoon's methodology
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-62727 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-62727 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Kludex', 'product': 'starlette', 'versions': [{'status': 'affected', 'version': '>= 0.39.0, < 0.49.1'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-62727', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-10-28T20:36:34.130234Z'} -
CVE Modified by [email protected]
Nov. 04, 2025
Action Type Old Value New Value Changed Description Starlette is a lightweight ASGI framework/toolkit. Prior to 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1. Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1. Added Reference https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c Added Reference https://github.com/Kludex/starlette/releases/tag/0.49.1 -
New CVE Received by [email protected]
Oct. 28, 2025
Action Type Old Value New Value Added Description Starlette is a lightweight ASGI framework/toolkit. Prior to 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-407 Added Reference https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5 Added Reference https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 28, 2025
Action Type Old Value New Value Added Reference https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8