Executive brief
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Affected products
- PyPI starlette
Junglewise Threat Intelligence
CVE-2025-62727: PYSEC-2026-1942 - Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
CVE-2025-62727 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: starlette (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1941 - Starlette has possible denial-of-service vector when parsing large files in multipart forms
- PYSEC-2026-1943 - Starlette Denial of service (DoS) via multipart/form-data
- Starlette denial of service via resource limit bypass in request.form
- Kludex Starlette hostname spoofing via unvalidated request path
- Starlette unsafe reflection in HTTPEndpoint method dispatching