CVE-2025-62727highCWE-407

CVE-2025-62727: falha de alta gravidade em Kludex starlette

Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar starlette+ Monitorar starlette

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Kludex · starlette
CVEs relacionadas — Kludex starlette

No mesmo produto, das mais perigosas para as menos.

CVE-2026-48710MEDIUMStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksEPSS 70.3%KEVCVE-2026-54283HIGHStarlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoSEPSS 0.5%CVE-2026-48818HIGHStarlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on WindowsEPSS 0.4%CVE-2026-54282LOWStarlette: Unvalidated request path concatenated into authority poisons request.url.hostnameEPSS 0.3%CVE-2026-48817MEDIUMStarlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`EPSS 0.2%