StackRadar

CVE-2025-62727

High

Advisory

Published 28 Oct 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
39
of 17,781 indexed, latest versions
Container images
55
deployed by those charts
Fix available
1 of 1
affected package

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Carried by container images the latest versions of 39 of 17,781 indexed charts deploy, on 55 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.39.2, 0.40.0, 0.41.0, 0.41.2+7 more0.49.155
OSV records
GHSA-7f5h-v6xp-fcq8
Also known as
PYSEC-2026-1942

Charts affected

39 by stars
ChartLatestAffected imagesRadar Score
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
starlette@0.45.3
0.49.1

Open the chart page →

17,245
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
starlette@0.39.2
0.49.1

Open the chart page →

6,168
backendikusi-bk-chart1.0.32 of 3See more

backend ikusi-bk-chart 1.0.3

2 of the 3 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
kyovint/kyoimgtransactions:1.0.048c19e3ae9a3
starlette@0.47.3
0.49.1
kyovint/kyoimgusers:1.0.080084149156e
starlette@0.47.3
0.49.1

Open the chart page →

5,940
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
starlette@0.41.2
0.49.1

Open the chart page →

15,712
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
starlette@0.41.3
0.49.1

Open the chart page →

4,292
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
starlette@0.41.0
0.49.1

Open the chart page →

3,929
vuiseriohub1.0.62 of 3See more

vui seriohub 1.0.6

2 of the 3 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
starlette@0.45.3
0.49.1
dserio83/velero-watchdog:0.1.8d5deae589229
starlette@0.45.3
0.49.1

Open the chart page →

11,532
slo-reportingslo-reportingVerified publisher0.3.341 of 2See more

slo-reporting slo-reporting 0.3.34

1 of the 2 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
starlette@0.41.3
0.49.1

Open the chart page →

2,928
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
starlette@0.46.2
0.49.1

Open the chart page →

12,907
airbyteairbyte-v2Verified publisher2.2.01 of 10See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.23.73b3a670af168
starlette@0.47.3
0.49.1

Open the chart page →

12,473
esphomealexmorbo-esphomeVerified publisher1.0.01 of 1See more

esphome alexmorbo-esphome 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
esphome/esphome:2024.12.2b2c6322700ac
starlette@0.39.2
0.49.1

Open the chart page →

6,324
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
starlette@0.46.2
0.49.1

Open the chart page →

40,238
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
starlette@0.46.2
0.49.1

Open the chart page →

26,996
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
starlette@0.46.2
0.49.1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
starlette@0.41.2
0.49.1

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
starlette@0.41.2
0.49.1

Open the chart page →

11,335
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
0.49.1

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
0.49.1

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
starlette@0.41.0
0.49.1

Open the chart page →

19,224
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
starlette@0.47.3
0.49.1

Open the chart page →

10,270
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latestf9f34c8ed688
starlette@0.46.2
0.49.1

Open the chart page →

1,683
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
starlette@0.39.2
0.49.1

Open the chart page →

6,008
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
starlette@0.46.0
0.49.1

Open the chart page →

4,647
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
starlette@0.41.3
0.49.1

Open the chart page →

5,062
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
starlette@0.48.0
0.49.1

Open the chart page →

17,852
graphiti-mcpkiberonlabs0.1.21 of 1See more

graphiti-mcp kiberonlabs 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
starlette@0.47.1
0.49.1

Open the chart page →

3,393
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
starlette@0.46.2
0.49.1

Open the chart page →

8,405
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/kubiyabot/sdk-py:v1.20.0f108f49570cc
starlette@0.39.2
0.49.1

Open the chart page →

20,204
lightlyticslightlytics0.1.211 of 2See more

lightlytics lightlytics 0.1.21

1 of the 2 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
starlette@0.41.3
0.49.1

Open the chart page →

5,354
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
starlette@0.45.3
0.49.1

Open the chart page →

5,823
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
starlette@0.41.3
0.49.1

Open the chart page →

7,310
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
quay.io/ai-lab/llamacpp_python:latest70d138997acd
starlette@0.46.2
0.49.1

Open the chart page →

18,922
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.016 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

16 of the 40 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-mediator:latest42efc445b19e
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-server:latestce1132261523
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
starlette@0.46.2
0.49.1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
starlette@0.46.2
0.49.1

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
starlette@0.46.2
0.49.1

Open the chart page →

6,583
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
starlette@0.40.0
0.49.1

Open the chart page →

5,706
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
starlette@0.46.2
0.49.1

Open the chart page →

16,196
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
starlette@0.41.3
0.49.1

Open the chart page →

3,332
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
0.49.1

Open the chart page →

3,781
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
0.49.1

Open the chart page →

9,607
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2025-62727.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
0.49.1

Open the chart page →

3,707

Container images carrying it

55 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
0.49.1
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
starlette@0.41.3
0.49.1
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
starlette@0.46.2
0.49.1
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
starlette@0.41.3
0.49.1
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
0.49.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.