Starlette is a lightweight ASGI framework/toolkit. Prior to 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-43a0bff5ea advisory.

    ## uv 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518.

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Initial package for `python-uv-build` in Fedora 42
    - Initial packages for a number of new dependencies for `ruff` and `uv`.
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1.
    - Patch `openapi-python-client` to allow `ruff` 0.14


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-a77c1f005b advisory.

    ## uv 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518.

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Initial package for `python-uv-build` in Fedora 42
    - Initial packages for a number of new dependencies for `ruff` and `uv`
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1
    - Update `openapi-python-client` to 0.26.2 and patch it to allow `ruff` 0.14

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starlette is a lightweight ASGI framework/toolkit. Prior to 0.49.1 , an unauthenticated attacker can send     a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range     parsing/merging logic. This enables CPU exhaustion per request, causing denialofservice for endpoints     serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.
    (CVE-2025-62727)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
272181	Fedora 41 : openapi-python-client / python-uv-build / ruff / etc (2025-43a0bff5ea)	Nessus	Fedora Local Security Checks	high
272180	Fedora 42 : openapi-python-client / python-uv-build / ruff / etc (2025-a77c1f005b)	Nessus	Fedora Local Security Checks	high
271968	Linux Distros Unpatched Vulnerability : CVE-2025-62727	Nessus	Misc.	high

Detections

Analytics

CVE-2025-62727

high

Tenable Plugins

high

high

high