← Volver a CVEs

CVE-2025-62727

HIGH

7.5

Descripcion

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado10/28/2025

Ultima modificacion11/4/2025

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-407

Referencias

https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5(security-advisories@github.com)

https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c(security-advisories@github.com)

https://github.com/Kludex/starlette/releases/tag/0.49.1(security-advisories@github.com)

https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8(security-advisories@github.com)

https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.