Starlette versions from 0.39.0 up to but not including 0.49.1 contain a vulnerability in the FileResponse component where processing of crafted HTTP Range headers triggers quadratic-time complexity. This can lead to CPU exhaustion and denial-of-service (DoS) conditions on endpoints serving files, including StaticFiles and any direct use of FileResponse. The vulnerability arises from inefficient parsing and merging of multiple range requests, allowing an unauthenticated attacker to cause high CPU usage with a single request.