CVE-2025-62727: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
(updated )
An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette’s FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse).
References
- github.com/Kludex/starlette
- github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5
- github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c
- github.com/Kludex/starlette/releases/tag/0.49.1
- github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8
- github.com/advisories/GHSA-7f5h-v6xp-fcq8
- nvd.nist.gov/vuln/detail/CVE-2025-62727
Code Behaviors & Features
Detect and mitigate CVE-2025-62727 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →