https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:18:48 +0000 https://cve.radiocsirt.org/vuln/brew-cycode-cve-2025-62727 <p><strong>Affected:</strong> Homebrew: cycode</p> <p>### Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).</p> <p>### Details Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.</p> <p>```python # starlette/responses.py _RANGE_PATTERN = re.compile(r&#34;(\d*)-(\d*)&#34;) # vulnerable to O(n^2) complexity ReDoS</p> <p>class FileResponse(Response): @staticmethod def _parse_range_header(http_range: str, file_size: int) -&gt; list[tuple[int, int]]: ranges: list[tuple[int, int]] = [] try: units, range_ = http_range.split(&#34;=&#34;, 1) except ValueError: raise MalformedRangeHeader()</p> <p># [...]</p> <p>ranges = [ ( int(_[0]) if _[0] else file_size - int(_[1]), int(_[1]) + 1 if _[0] and _[1] and int(_[1]) &lt; file_size else file_size, ) for _ in _RANGE_PATTERN.findall(range_) # vulnerable if _ != (&#34;&#34;, &#34;&#34;) ]</p> <p>```</p> <p>The parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.</p> <p>The merge loop processes each input range by scanning the entire resul…</p> <p><strong>Affected:</strong> Homebrew: cycode</p> <p>### Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).</p> <p>### Details Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.</p> <p>```python # starlette/responses.py _RANGE_PATTERN = re.compile(r&#34;(\d*)-(\d*)&#34;) # vulnerable to O(n^2) complexity ReDoS</p> <p>class FileResponse(Response): @staticmethod def _parse_range_header(http_range: str, file_size: int) -&gt; list[tuple[int, int]]: ranges: list[tuple[int, int]] = [] try: units, range_ = http_range.split(&#34;=&#34;, 1) except ValueError: raise MalformedRangeHeader()</p> <p># [...]</p> <p>ranges = [ ( int(_[0]) if _[0] else file_size - int(_[1]), int(_[1]) + 1 if _[0] and _[1] and int(_[1]) &lt; file_size else file_size, ) for _ in _RANGE_PATTERN.findall(range_) # vulnerable if _ != (&#34;&#34;, &#34;&#34;) ]</p> <p>```</p> <p>The parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.</p> <p>The merge loop processes each input range by scanning the entire resul…</p> https://cve.radiocsirt.org/vuln/brew-cycode-cve-2025-62727 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1138 certfr-2025-avi-1138 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1138 https://cve.radiocsirt.org/vuln/cleanstart-2026-al63130 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: litellm-database</p> <p>Package litellm-database version 1.96.0-r0 fixes 5 vulnerabilities: CVE-2026-54282, CVE-2025-62727, CVE-2026-48818, CVE-2026-54283, CVE-2025-54121</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: litellm-database</p> <p>Package litellm-database version 1.96.0-r0 fixes 5 vulnerabilities: CVE-2026-54282, CVE-2025-62727, CVE-2026-48818, CVE-2026-54283, CVE-2025-54121</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-al63130 https://cve.radiocsirt.org/vuln/euvd-2026-259072 EUVD-2026-259072 https://cve.radiocsirt.org/vuln/euvd-2026-259072 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62727 <p>Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.</p> <p>Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-62727 https://cve.radiocsirt.org/vuln/ghsa-7f5h-v6xp-fcq8 <p><strong>Affected:</strong> PyPI: starlette</p> <p>### Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).</p> <p>### Details Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.</p> <p>```python # starlette/responses.py _RANGE_PATTERN = re.compile(r&#34;(\d*)-(\d*)&#34;) # vulnerable to O(n^2) complexity ReDoS</p> <p>class FileResponse(Response): @staticmethod def _parse_range_header(http_range: str, file_size: int) -&gt; list[tuple[int, int]]: ranges: list[tuple[int, int]] = [] try: units, range_ = http_range.split(&#34;=&#34;, 1) except ValueError: raise MalformedRangeHeader()</p> <p># [...]</p> <p>ranges = [ ( int(_[0]) if _[0] else file_size - int(_[1]), int(_[1]) + 1 if _[0] and _[1] and int(_[1]) &lt; file_size else file_size, ) for _ in _RANGE_PATTERN.findall(range_) # vulnerable if _ != (&#34;&#34;, &#34;&#34;) ]</p> <p>```</p> <p>The parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.</p> <p>The merge loop processes each input range by scanning the entire resul…</p> <p><strong>Affected:</strong> PyPI: starlette</p> <p>### Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).</p> <p>### Details Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.</p> <p>```python # starlette/responses.py _RANGE_PATTERN = re.compile(r&#34;(\d*)-(\d*)&#34;) # vulnerable to O(n^2) complexity ReDoS</p> <p>class FileResponse(Response): @staticmethod def _parse_range_header(http_range: str, file_size: int) -&gt; list[tuple[int, int]]: ranges: list[tuple[int, int]] = [] try: units, range_ = http_range.split(&#34;=&#34;, 1) except ValueError: raise MalformedRangeHeader()</p> <p># [...]</p> <p>ranges = [ ( int(_[0]) if _[0] else file_size - int(_[1]), int(_[1]) + 1 if _[0] and _[1] and int(_[1]) &lt; file_size else file_size, ) for _ in _RANGE_PATTERN.findall(range_) # vulnerable if _ != (&#34;&#34;, &#34;&#34;) ]</p> <p>```</p> <p>The parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.</p> <p>The merge loop processes each input range by scanning the entire resul…</p> https://cve.radiocsirt.org/vuln/ghsa-7f5h-v6xp-fcq8 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15696-1 <p>python311-starlette-0.49.1-1.1 on GA media</p> <p>python311-starlette-0.49.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15696-1 https://cve.radiocsirt.org/vuln/pysec-2026-1942 <p><strong>Affected:</strong> PyPI: starlette</p> <p>### Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).</p> <p>### Details Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.</p> <p>```python # starlette/responses.py _RANGE_PATTERN = re.compile(r&#34;(\d*)-(\d*)&#34;) # vulnerable to O(n^2) complexity ReDoS</p> <p>class FileResponse(Response): @staticmethod def _parse_range_header(http_range: str, file_size: int) -&gt; list[tuple[int, int]]: ranges: list[tuple[int, int]] = [] try: units, range_ = http_range.split(&#34;=&#34;, 1) except ValueError: raise MalformedRangeHeader()</p> <p># [...]</p> <p>ranges = [ ( int(_[0]) if _[0] else file_size - int(_[1]), int(_[1]) + 1 if _[0] and _[1] and int(_[1]) &lt; file_size else file_size, ) for _ in _RANGE_PATTERN.findall(range_) # vulnerable if _ != (&#34;&#34;, &#34;&#34;) ]</p> <p>```</p> <p>The parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.</p> <p>The merge loop processes each input range by scanning the entire resul…</p> <p><strong>Affected:</strong> PyPI: starlette</p> <p>### Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s `FileResponse` Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., `StaticFiles` or any use of `FileResponse`).</p> <p>### Details Starlette parses multi-range requests in ``FileResponse._parse_range_header()``, then merges ranges using an O(n^2) algorithm.</p> <p>```python # starlette/responses.py _RANGE_PATTERN = re.compile(r&#34;(\d*)-(\d*)&#34;) # vulnerable to O(n^2) complexity ReDoS</p> <p>class FileResponse(Response): @staticmethod def _parse_range_header(http_range: str, file_size: int) -&gt; list[tuple[int, int]]: ranges: list[tuple[int, int]] = [] try: units, range_ = http_range.split(&#34;=&#34;, 1) except ValueError: raise MalformedRangeHeader()</p> <p># [...]</p> <p>ranges = [ ( int(_[0]) if _[0] else file_size - int(_[1]), int(_[1]) + 1 if _[0] and _[1] and int(_[1]) &lt; file_size else file_size, ) for _ in _RANGE_PATTERN.findall(range_) # vulnerable if _ != (&#34;&#34;, &#34;&#34;) ]</p> <p>```</p> <p>The parsing loop of ``FileResponse._parse_range_header()`` uses the regular expression which vulnerable to denial of service for its O(n^2) complexity. A crafted `Range` header can maximize its complexity.</p> <p>The merge loop processes each input range by scanning the entire resul…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1942 https://cve.radiocsirt.org/vuln/rhsa-2025:22759 <p>keras: Arbitary Code execution in Keras load_model() keras: Keras Path Traversal Vulnerability database/sql: Postgres Scan Race Condition aiohttp: AIOHTTP HTTP Request/Response Smuggling golang: archive/tar: Unbounded allocation when parsing GNU sparse map axios: Axios DoS via lack of data size check github.com/argoproj/argo-workflows: Argo Workflows Zip Slip starlette: Starlette DoS via Range header merging</p> <p>keras: Arbitary Code execution in Keras load_model() keras: Keras Path Traversal Vulnerability database/sql: Postgres Scan Race Condition aiohttp: AIOHTTP HTTP Request/Response Smuggling golang: archive/tar: Unbounded allocation when parsing GNU sparse map axios: Axios DoS via lack of data size check github.com/argoproj/argo-workflows: Argo Workflows Zip Slip starlette: Starlette DoS via Range header merging</p> https://cve.radiocsirt.org/vuln/rhsa-2025:22759 https://cve.radiocsirt.org/vuln/suse-su-2026:22151-1 <p>Security update for python-starlette</p> <p>Security update for python-starlette</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22151-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-62727 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: starlette, Ubuntu:24.04:LTS: starlette, Ubuntu:25.10: starlette, Ubuntu:26.04:LTS: starlette</p> <p>Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: starlette, Ubuntu:24.04:LTS: starlette, Ubuntu:25.10: starlette, Ubuntu:26.04:LTS: starlette</p> <p>Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette&#39;s FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-62727