ByteOS Network

NVD Vulnerability Details :

CVE-2025-62727

Awaiting Analysis

Source-security-advisories@github.com

Published At-28 Oct, 2025 | 21:15

Updated At-04 Nov, 2025 | 18:16

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE ID	Type	Source
CWE-407	Secondary	security-advisories@github.com

CWE ID: CWE-407

Type: Secondary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5	security-advisories@github.com	N/A
https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c	security-advisories@github.com	N/A
https://github.com/Kludex/starlette/releases/tag/0.49.1	security-advisories@github.com	N/A
https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8	security-advisories@github.com	N/A
https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A