Description
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kludex | starlette | >= 0.39.0, < 0.49.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | starlette | 0.50.0-1 | — |
| Debian 13 | starlette | 0.46.1-3+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | starlette | No fix yet | — |
| Ubuntu 26.04 LTS | starlette | No fix yet | — |
| Ubuntu 25.10 | starlette | No fix yet | — |
| Ubuntu 24.04 LTS | starlette | No fix yet | — |
| Ubuntu 22.04 LTS | starlette | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-starlette | 0.41.3-160000.3.1 | SUSE-SU-2026:22151-1 |
| SLES 16.0 | python-starlette | 0.41.3-160000.3.1 | SUSE-SU-2026:22151-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-sse-starlette | 3.2.0-1.1 | openSUSE-SU-2026:10109-1 |
| openSUSE Tumbleweed | python-starlette | 0.49.1-1.1 | openSUSE-SU-2025:15696-1 |
| openSUSE Leap 16.0 | python-starlette | 0.41.3-160000.3.1 | openSUSE-SU-2026:20975-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.0-r0 | — |
| Wolfi rolling | airflow-3-bitnami-compat | No fix yet | — |
| Wolfi rolling | k8s-sidecar | 2.0.3-r0 | — |
| Wolfi rolling | kserve +8 | 0.15.2-r6 | — |
| Wolfi rolling | kserve-agent | 0.16.0-r5 | — |
| Wolfi rolling | open-webui +1 | 0.6.34-r2 | — |
| Wolfi rolling | reflex | 0.8.17-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
ch4n3-yoon/CVE-2025-62727-Demo ★ 1 · Oct 28, 2025
Proof of concept of CVE-2025-62727 that can cause denial-of-service in FastAPI (based Starlette <= 0.48.0)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | starlette | >= 0.39.0, < 0.49.1 | 0.49.1 | GHSA-7f5h-v6xp-fcq8 |
Advisories 4
- openSUSE-SU-2026:20975-1 Security update for python-starlette SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22151-1 Security update for python-starlette SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:10109-1 python311-sse-starlette-3.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15696-1 python311-starlette-0.49.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026