CVE-2025-62727
Fixed in a distro release EPSS <1%CVSS 7.5
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
Products: Kludex starlette
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | starlette | 0.49.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-3 | 3.2.0-r0 |
| Chainguard | airflow-3-bitnami-compat | no fix |
| Chainguard | airflow-core-3 | 3.2.0-r2 |
| Chainguard | k8s-sidecar | 2.0.3-r0 |
| Chainguard | kserve | 0.16.0-r5 |
| Chainguard | kserve | 0.15.2-r6 |
| Chainguard | kserve-agent | 0.16.0-r5 |
| Chainguard | kserve-agent-compat | 0.15.2-r6 |
| Chainguard | kserve-agent-compat | 0.16.0-r5 |
| Chainguard | kserve-manager | 0.15.2-r6 |
| Chainguard | kserve-manager | 0.16.0-r5 |
| Chainguard | kserve-manager-compat | 0.16.0-r5 |
| Chainguard | kserve-manager-compat | 0.15.2-r6 |
| Chainguard | kserve-qpext | 0.15.2-r6 |
| Chainguard | kserve-qpext | 0.16.0-r5 |
| Chainguard | kserve-qpext-compat | 0.15.2-r6 |
| Chainguard | kserve-qpext-compat | 0.16.0-r5 |
| Chainguard | kserve-router | 0.16.0-r5 |
| Chainguard | kserve-router | 0.15.2-r6 |
| Chainguard | kserve-router-compat | 0.15.2-r6 |
| Chainguard | kserve-router-compat | 0.16.0-r5 |
| Chainguard | kserve-storage-controller | 0.16.0-r5 |
| Chainguard | kserve-storage-controller | 0.15.2-r6 |
| Chainguard | mlflow | 3.5.1-r1 |
| Chainguard | mlflow-bitnami | 3.5.1-r1 |
| Chainguard | mlflow-iamguarded-compat | 3.5.1-r1 |
| Chainguard | nemo | 2.5.2-r1 |
| Chainguard | open-webui | 0.6.34-r2 |
| Chainguard | open-webui-compat | 0.6.34-r2 |
| Chainguard | reflex | 0.8.17-r0 |
| Debian 13 | starlette | 0.46.1-3+deb13u1 |
| Debian 14 | starlette | 0.50.0-1 |
| SUSE Linux Enterprise Server 16.0 | python-starlette | 0.41.3-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-starlette | 0.41.3-160000.3.1 |
| Ubuntu 22.04 LTS | starlette | no fix |
| Ubuntu 24.04 LTS | starlette | no fix |
| Ubuntu 25.10 | starlette | no fix |
| Ubuntu 26.04 LTS | starlette | no fix |
| Ubuntu 26.10 | starlette | no fix |
| Wolfi | airflow-3 | 3.2.0-r0 |
| Wolfi | airflow-3-bitnami-compat | no fix |
| Wolfi | k8s-sidecar | 2.0.3-r0 |
| Wolfi | kserve | 0.15.2-r6 |
| Wolfi | kserve | 0.16.0-r5 |
| Wolfi | kserve-agent | 0.16.0-r5 |
| Wolfi | kserve-agent-compat | 0.15.2-r6 |
| Wolfi | kserve-agent-compat | 0.16.0-r5 |
| Wolfi | kserve-manager | 0.16.0-r5 |
| Wolfi | kserve-manager | 0.15.2-r6 |
| Wolfi | kserve-manager-compat | 0.16.0-r5 |
| Wolfi | kserve-manager-compat | 0.15.2-r6 |
| Wolfi | kserve-qpext | 0.15.2-r6 |
| Wolfi | kserve-qpext | 0.16.0-r5 |
| Wolfi | kserve-qpext-compat | 0.15.2-r6 |
| Wolfi | kserve-qpext-compat | 0.16.0-r5 |
| Wolfi | kserve-router | 0.16.0-r5 |
| Wolfi | kserve-router | 0.15.2-r6 |
| Wolfi | kserve-router-compat | 0.16.0-r5 |
| Wolfi | kserve-router-compat | 0.15.2-r6 |
| Wolfi | kserve-storage-controller | 0.16.0-r5 |
| Wolfi | kserve-storage-controller | 0.15.2-r6 |
| Wolfi | mlflow | 3.5.1-r1 |
| Wolfi | mlflow-bitnami | 3.5.1-r1 |
| Wolfi | mlflow-iamguarded-compat | 3.5.1-r1 |
| Wolfi | open-webui | 0.6.34-r2 |
| Wolfi | open-webui-compat | 0.6.34-r2 |
| Wolfi | reflex | 0.8.17-r0 |
| openSUSE Leap 16.0 | python-starlette | 0.41.3-160000.3.1 |
| openSUSE Tumbleweed | python-sse-starlette | 3.2.0-1.1 |
| openSUSE Tumbleweed | python-starlette | 0.49.1-1.1 |