Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse
Priority HIGH 72CWE-407Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.
Summary
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.008 56th percentileScored 2026-11-07
Fix Partial starlette (Kludex): 0.49.1starlette (PyPI): 0.49.1Red Hat: 11 advisoriesRed Hat: 7 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kludex | starlette | 0.39.0 to before 0.49.1 | 0.49.1 | Patch available | CNA |
| — | starlette (PyPI) | 0.39.0 to before 0.49.1 | 0.49.1 | Patch available | GHSA-7f5h-v6xp-fcq8 |
- starlette VendorKludex Affected 0.39.0 to before 0.49.1 Fixed in 0.49.1 Patch available CNA
- starlette (PyPI) Vendor— Affected 0.39.0 to before 0.49.1 Fixed in 0.49.1 Patch available GHSA-7f5h-v6xp-fcq8
Remediation
- Fix · CNA starlette (Kludex) Fixed in 0.49.1
- Fix · GHSA-7f5h-v6xp-fcq8 starlette (PyPI) Fixed in 0.49.1 Advisory →
Red Hat 11 advisories
- RHSA-2026:44696 Released 2026-07-23 · Red Hat rating Importantsatellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9
- RHSA-2026:22993 Released 2026-06-03 · Red Hat rating Importantsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
- RHSA-2026:3462 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (ROCm)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
Show 8 more Red Hat advisories
- RHSA-2026:3461 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
- RHSA-2025:23531 Released 2025-12-17 · Red Hat rating ImportantRHOAI 2.25.1 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9 +34
- RHSA-2025:23133 Released 2025-12-11 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9-operator, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +3
- RHSA-2025:23131 Released 2025-12-11 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/eda-controller-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8 +2
- RHSA-2025:23080 Released 2025-12-10 · Red Hat rating ImportantRed Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
- RHSA-2025:23079 Released 2025-12-10 · Red Hat rating ImportantRed Hat AI Inference Server 3.2.2 (ROCm)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2025:23078 Released 2025-12-10 · Red Hat rating ImportantRed Hat AI Inference Server 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
- RHSA-2025:22759 Released 2025-12-04 · Red Hat rating ImportantRHOAI 2.22.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.22 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat AI Inference Server 3.2 | Fixed | RHSA-2025:23078, RHSA-2025:23079, RHSA-2025:23080, RHSA-2026:3461, RHSA-2026:3462 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2025:23131 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2025:23133 |
| Red Hat OpenShift AI 2.22 | Fixed | RHSA-2025:22759 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2025:23531 |
| Red Hat Satellite 6.17 | Fixed | RHSA-2026:44696 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:22993 |
Not affected: 8 products
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.22
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift distributed tracing 3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62727
- 2026-10-03 Alias added: GHSA-7f5h-v6xp-fcq8
- 2026-10-10 Affected versions changed · Red Hat
References
Other 5
- https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8
- https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5
- https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c
- https://github.com/Kludex/starlette/releases/tag/0.49.1
- https://github.com/Kludex/starlette
More Kludex vulnerabilities
- TI-2026-30841 Python-Multipart: Denial of Service via unbounded multipart part headers CVSS 3.1HIGH 7.5
- TI-2024-36140 python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary CVSS 3.1HIGH 7.5
Sources
- CVE-2025-62727 · CVE Program
- CVE-2025-62727 · NVD
- FIRST EPSS
- GHSA-7f5h-v6xp-fcq8 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-62727 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences