Security Bulletin: Starlette FileResponse Range Header Parsing DoS Vulnerability, affects watsonx.data

Summary Starlette versions 0.39.0–0.49.0 allow unauthenticated attackers to cause CPU exhaustion by sending crafted HTTP Range headers to file-serving endpoints. The issue is fixed in version 0.49.1. This can affect watsonx.data. Vulnerability Details CVEID:CVE-2025-62727 DESCRIPTION: Starlette i...

python311-sse-starlette-3.2.0-1.1 on GA media (moderate)

python311-sse-starlette-3.2.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10109-1 Rating: moderate Cross-References: CVE-2025-62727 CVSS scores: CVE-2025-62727 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-62727 SUSE : 8.2...

OPENSUSE-SU-2026:10109-1 python311-sse-starlette-3.2.0-1.1 on GA media

These are all security issues fixed in the python311-sse-starlette-3.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-43329

Name of the Vulnerable Software and Affected Versions Starlette versions prior to 1.0.1 Description Starlette, a lightweight ASGI Asynchronous Server Gateway Interface framework, fails to validate the HTTP Host request header before using it to reconstruct request.url. While the routing algorithm...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 2.2.0 Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a lightweight ASGI Asynchronous Server Gateway Interface framework/toolkit, designed for building async web services in Python. In versions...

Denial Of Service (DoS)

Starlette is vulnerable to Denial Of Service DoS. The vulnerability is due to quadratic-time processing in the FileResponse HTTP Range header parsing and merging logic, which allows an unauthenticated attacker to send a crafted Range header to exhaust CPU resources...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service [CVE-2025-54121]

Summary Python module starlette is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service. This bulletin provides patch information to address the reported...

Security Bulletin: There is a vulnerability in starlette-0.40.0-py3-none-any.whl used by IBM Maximo Visual Inspection application in IBM Maximo Application Suite ( CVE-2025-54121)

Summary There is a vulnerability in starlette-0.40.0-py3-none-any.whl used by IBM Maximo Visual Inspection application in IBM Maximo Application Suite CVE-2025-54121. This Bulletine contains the information regarding affected and remediation versions of the same. Vulnerability Details...

Security Bulletin: Astronomer with IBM is vulnerable to event thread locking due to the starlette package (CVE-2025-54121)

Summary Starlette is used by Astronomer with IBM as part of the request processing functionality. Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a lightweight ASGI Asynchronous Server Gateway Interface framework/toolkit, designed for building async web services in Python. In...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 2.1.0 Vulnerability Details CVEID:CVE-2025-6493 DESCRIPTION: A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown...

Fedora: Security Advisory (FEDORA-2025-10d2e6260b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-4520cf6bac)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in IBM Business Automation Workflow Machine Learning Server are addressed with 24.0.0-IF007

Summary In addition to updates to operating system level packages, IBM Business Automation Workflow Machine Learning Server 24.0.0-IF007 addresses the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a lightweight ASGI Asynchronous Server Gateway...

[SECURITY] Fedora 41 Update: python-starlette-0.42.0-3.fc41

Starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It is production-ready, and gives you the following: =E2=80=A2 A lightweight, low-complexity HTTP web framework. =E2=80=A2 WebSocket support. =E2=80=A2 In-process background tasks. =E2=80=...

Fedora 42 : python-starlette (2025-4520cf6bac)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4520cf6bac advisory. Backport security fix for CVE-2025-62727, GHSA-7f5h-v6xp-fcq8 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Fedora 41 : python-starlette (2025-10d2e6260b)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-10d2e6260b advisory. Backport security fix for CVE-2025-62727, GHSA-7f5h-v6xp-fcq8 Tenable has extracted the preceding description block directly from the Fedora security advisor...

[SECURITY] Fedora 43 Update: python-starlette-0.49.1-1.fc43

Starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It is production-ready, and gives you the following: =E2=80=A2 A lightweight, low-complexity HTTP web framework. =E2=80=A2 WebSocket support. =E2=80=A2 In-process background tasks. =E2=80=...

python311-starlette-0.49.1-1.1 on GA media (moderate)

python311-starlette-0.49.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15696-1 Rating: moderate Cross-References: CVE-2025-62727 CVSS scores: CVE-2025-62727 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-62727 SUSE : 8.2...

OPENSUSE-SU-2025:15696-1 python311-starlette-0.49.1-1.1 on GA media

These are all security issues fixed in the python311-starlette-0.49.1-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2025-62727

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion...