Denial of Service Vulnerability in Starlette Framework by Kludex
CVE-2025-62727
Key Information:
Badges
What is CVE-2025-62727?
Prior to version 0.49.1, the Starlette framework, designed for ASGI applications, suffers from a denial of service vulnerability. An unauthenticated attacker can exploit this issue by sending a specially crafted HTTP Range header. This triggers inefficient quadratic-time processing within the FileResponse's Range parsing and merging logic, leading to CPU exhaustion during requests. Consequently, this results in service unavailability for web endpoints that serve files, such as StaticFiles or any usage of FileResponse. The issue has been resolved in version 0.49.1.
Affected Version(s)
starlette < 0.49.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.