Skip to main content
CVE-2025-62727VulnerabilityPublished 08/13/2026Updated 10/22/2026

Fastmcp: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` (CVE-2025-62727)

Affects fastmcpSource GCVE Database

0
CVSS 3.1 base score
7.5High
How severe the flaw is on the 0–10 CVSS scale.
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.8% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 0.42_1, 2.13.0.2_1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What to do

Affected software

ProductAffectedFixed in
Homebrewkimi-clipkg:brew/kimi-cliOther threatsAffected
  • >=0.40 <0.42_1
Fixed in
  • 0.42_1
Homebrewfastmcppkg:brew/fastmcpOther threatsAffected
  • >=2.12.3 <2.13.0.2_1
Fixed in
  • 2.13.0.2_1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat advises monitoring their advisories for updates. Users should consult Red Hat Satellite documentation for integration guidance and consider limiting exposure of affected endpoints if possible. Customers with a Red Hat Technical Account Manager (TAM) can discuss this CVE directly for tailored advice. No specific mitigations are provided by Red Hat at this time.

Description

This adds the satellite/iop-advisor-engine-rhel9 image to the Red Hat container registry. To pull this container image, run the following command: podman pull registry.redhat.io/satellite/iop-advisor-engine-rhel9

Impact

The vulnerability allows an unauthenticated attacker to cause high CPU usage on affected systems by sending specially crafted HTTP Range headers, resulting in denial of service conditions for endpoints serving files. This can disrupt availability of services relying on the Starlette framework within Red Hat Satellite and related containerized components. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Summary

CVE-2025-62727 is a denial of service vulnerability in the python Starlette framework's FileResponse Range header parsing and merging logic. Specifically, an attacker can craft an HTTP Range header that causes quadratic-time processing, leading to excessive CPU consumption per request. This vulnerability impacts Red Hat Satellite container images such as satellite/iop-advisor-engine-rhel9 and related products that incorporate this component. Red Hat has published advisories (RHSA-2026:22993) describing the issue but has not provided an official fix or patch, citing lack of suitable mitigation options that meet their criteria for ease of use, applicability, and stability. The vulnerability is associated with multiple CWEs including inefficient algorithmic complexity (CWE-407) and others related to denial of service.

Weaknesses

References

Community reviews

Loading reviews…