Threats tagged 'brew-mcpm-cve-2025-62727'

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that leads to quadratic-time complexity. An unauthenticated attacker can craft a Range header with many small or specially shaped ranges, causing excessive CPU usage and denial of service on endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is identified as CVE-2025-62727 and has a CVSS score of 7.5 (high severity). A fix is available in version 2.9.0_1.