7.5

CVE-2025-62727: kludex starlette Inefficient Algorithmic Complexity

CVSS: 7.5v3.1HighDeferred
AliasesGHSA-7f5h-v6xp-fcq8PYSEC-2026-1942UBUNTU-CVE-2025-62727
Published 28-10-2025Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2025-62727 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in kludex starlette. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.80%
0%100%
Low · +0.16 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 6
MGASA-2026-0327OPENSUSE-SU-2026:20975-1SUSE-SU-2026:22151-1CGA-7C8H-GP74-JVP4CGA-MF72-M4C8-PFR4CGA-MWR9-WHH6-3PPF

Timeline

  1. 28-10-2025
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

+0.16 pp

From 0.64% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard20 products
  • airflow-3< 3.2.0-r0
  • airflow-3-bitnami-compatAll versions (No fix recorded)
  • airflow-core-3< 3.2.0-r2
  • k8s-sidecar< 2.0.3-r0
  • kserve< 0.15.2-r6 | < 0.16.0-r5
Wolfi18 products
  • airflow-3< 3.2.0-r0
  • airflow-3-bitnami-compatAll versions (No fix recorded)
  • k8s-sidecar< 2.0.3-r0
  • kserve< 0.15.2-r6 | < 0.16.0-r5
  • kserve-agent< 0.16.0-r5
Opensuse2 products
  • python-sse-starlette&distro=openSUSE Tumbleweed< 3.2.0-1.1
  • python-starlette&distro=openSUSE Tumbleweed< 0.49.1-1.1
Debian1 product
  • starlette< 0.46.1-3+deb13u1 | < 0.50.0-1
Kludex1 product
PyPI1 product
  • starlette≥ 0.39.0, < 0.49.1
Ubuntu1 product
  • starletteAll versions (No fix recorded)

7 vendors · 44 products

References

13 links
Show all 13 references