A vulnerability in the Starlette framework allows unauthenticated attackers to cause a denial of service via resource exhaustion, posing a significant risk to application availability.

This vulnerability is an inefficient algorithmic complexity flaw (CWE-407) within the FileResponse range parsing logic. An unauthenticated attacker can send a specifically crafted HTTP Range header that forces the application into quadratic-time processing, effectively exhausting CPU resources per request.

The exploitation of this vulnerability directly impacts service availability by enabling attackers to crash or hang endpoints that serve static files. With a CVSS score of 7.5, this high-severity flaw can lead to significant operational disruption, potentially resulting in downtime for critical web services and impacting user experience or business continuity.

Immediate Action: Upgrade the Starlette package to version 0.49.1 or later to implement the corrected range parsing logic.

Proactive Monitoring: Monitor server CPU utilization and HTTP request logs for an unusual frequency of requests containing complex or malformed Range headers.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block HTTP requests with suspicious or excessively large Range headers before they reach the application layer.

Public Exploit Available: Yes, a public proof-of-concept exists (referenced via GitHub repository).

Given the availability of a public proof-of-concept and the ease of exploitation, organizations using the Starlette framework must prioritize updating to version 0.49.1. Failure to remediate this vulnerability leaves your infrastructure exposed to trivial denial-of-service attacks that require minimal effort from an adversary.