CVE-2025-62727 is a denial of service vulnerability in the python Starlette framework's FileResponse Range header parsing and merging logic. Specifically, an attacker can craft an HTTP Range header that causes quadratic-time processing, leading to excessive CPU consumption per request. This vulnerability impacts Red Hat Satellite container images such as satellite/iop-advisor-engine-rhel9 and related products that incorporate this component. Red Hat has published advisories (RHSA-2026:22993) describing the issue but has not provided an official fix or patch, citing lack of suitable mitigation options that meet their criteria for ease of use, applicability, and stability. The vulnerability is associated with multiple CWEs including inefficient algorithmic complexity (CWE-407) and others related to denial of service.

The vulnerability allows an unauthenticated attacker to cause high CPU usage on affected systems by sending specially crafted HTTP Range headers, resulting in denial of service conditions for endpoints serving files. This can disrupt availability of services relying on the Starlette framework within Red Hat Satellite and related containerized components. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Currently, no official patch or fix meeting Red Hat's criteria is available for this vulnerability. Red Hat advises monitoring their advisories for updates. Users should consult Red Hat Satellite documentation for integration guidance and consider limiting exposure of affected endpoints if possible. Customers with a Red Hat Technical Account Manager (TAM) can discuss this CVE directly for tailored advice. No specific mitigations are provided by Red Hat at this time.