CVE-2025-62727
Description
A denial of service vulnerability has been discovered in the python Starlette framework. an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This induces CPU exhaustion per request, causing a denial‑of‑service for endpoints serving files.
Statement
An IMPORTANT severity denial-of-service vulnerability was found in the Python Starlette ASGI framework, which is bundled with or used by a wide range of Red Hat offerings, including Red Hat Ansible Automation Platform, Red Hat OpenShift AI, Red Hat Enterprise Linux AI, Red Hat Satellite, Red Hat OpenShift distributed tracing, and Red Hat AI Inference Server. An unauthenticated remote attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range header parsing and merging logic. Each such request causes CPU exhaustion, resulting in a denial of service for applications that serve files, such as those using Starlette's StaticFiles or FileResponse. The Red Hat impact rating of IMPORTANT (CVSS 3.1 score of 7.5) matches the upstream severity. Because this flaw is handled through delegated resolution, fixes are being pursued by the individual affected product teams.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
