Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This vulnerability is fixed in 0.49.1.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4520cf6bac advisory.

    Backport security fix for CVE-2025-62727, GHSA-7f5h-v6xp-fcq8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-10d2e6260b advisory.

    Backport security fix for CVE-2025-62727, GHSA-7f5h-v6xp-fcq8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-4154ea83d0 advisory.

    ## uv / python-uv-build 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## Pydantic 2.12.3

    [Blog post](https://pydantic.dev/articles/pydantic-v2-12-release)

    ----

    ## maturin 1.9.6

    https://github.com/PyO3/maturin/blob/v1.9.6/Changelog.md

    ----

    ## python-typing-inspection 0.4.2 (2025-10-01)

    - Add `typing_objects.is_noextraitems()`

    ----

    ## python-jiter 0.11.0

    https://github.com/pydantic/jiter/releases/tag/v0.11.0

    ----

    ## python-pydantic-extra-types 2.10.6

    https://github.com/pydantic/pydantic-extra-types/releases/tag/v2.10.6

    ----

    # Typer

    ## 0.20.0

    ### Features

    *  Enable command suggestions on typo by default.

    ### Upgrades

    *  Add (official) support for Python 3.14.

    ### Internal

    Assorted small enhancements.

    ----

    # FastAPI

    ## 0.120.1

    ### Upgrades

    *  Bump Starlette to <`0.50.0`.

    ### Internal

    *  Add `license` and `license-files` to `pyproject.toml`, remove `License` from `classifiers`.

    ## 0.120.0

    There are no major nor breaking changes in this release. 

    The internal reference documentation now uses `annotated_doc.Doc` instead of `typing_extensions.Doc`, this     adds a new (very small) dependency on [`annotated-doc`](https://github.com/fastapi/annotated-doc), a     package made just to provide that `Doc` documentation utility class.

    I would expect `typing_extensions.Doc` to be deprecated and then removed at some point from     `typing_extensions`, for that reason there's the new `annotated-doc` micro-package. If you are curious     about this, you can read more in the repo for [`annotated-doc`](https://github.com/fastapi/annotated-doc).

    This new version `0.120.0` only contains that transition to the new home package for that utility class     `Doc`.

    ### Translations, Internal

    Assorted improvements.

    ## 0.119.1

    ### Fixes

    *  Fix internal Pydantic v1 compatibility (warnings) for Python 3.14 and Pydantic 2.12.1.

    ### Docs, Internal

    Assorted improvements.

    ## 0.119.0

    FastAPI now (temporarily) supports both Pydantic v2 models and `pydantic.v1` models at the same time in     the same app, to make it easier for any FastAPI apps still using Pydantic v1 to gradually but quickly
    **migrate to Pydantic v2**.

    ### Features

    *  Add support for `from pydantic.v1 import BaseModel`, mixed Pydantic v1 and v2 models in the same     app.

    ## 0.118.3

    ### Upgrades

    - Add (official) support for Python 3.14.

    ## 0.118.2

    ### Fixes

    *  Fix tagged discriminated union not recognized as body field.

    ## 0.118.1

    ### Upgrades

    *  Ensure compatibility with Pydantic 2.12.0.

    ### Docs, Translations, Internal

    Assorted bugfixes and enhancements.

    ## 0.118.0

    ### Fixes

    *  Fix support for `StreamingResponse`s with dependencies with `yield` or `UploadFile`s, close after     the response is done.

    Before FastAPI 0.118.0, if you used a dependency with `yield`, it would run the exit code after the *path     operation function* returned but right before sending the response.

    This change also meant that if you returned a `StreamingResponse`, the exit code of the dependency with     `yield` would have been already run.

    For example, if you had a database session in a dependency with `yield`, the `StreamingResponse` would not     be able to use that session while streaming data because the session would have already been closed in the     exit code after `yield`.

    This behavior was reverted in 0.118.0, to make the exit code after `yield` be executed after the response     is sent.

    You can read more about it in the docs for [Advanced Dependencies - Dependencies with `yield`,     `HTTPException`, `except` and Background Tasks](https://fastapi.tiangolo.com/advanced/advanced-     dependencies#dependencies-with-yield-httpexception-except-and-background-tasks). Including what you could     do if you wanted to close a database session earlier, before returning the response to the client.

    ### Docs, Translations, Internal

    Assorted bugfixes and enhancements.

    ----

    # Starlette

    ## 0.49.1 (October 28, 2025)

    This release fixes a security vulnerability in the parsing logic of the `Range` header in `FileResponse`.

    You can view the full security advisory: [GHSA-7f5h-v6xp-     fcq8](https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8)

    #### Fixed

    * Optimize the HTTP ranges parsing logic.

    ## 0.49.0 (October 28, 2025)

    #### Added

    * Add `encoding` parameter to `Config` class.
    * Support multiple cookie headers in `Request.cookies`.
    * Use `Literal` type for `WebSocketEndpoint` encoding values.

    #### Changed

    * Do not pollute exception context in `Middleware` when using `BaseHTTPMiddleware`.

    ----

    # FastAPI CLI

    ## 0.0.14

    ### Upgrades

    *  Add support for Python 3.13 and 3.14.

    ----

    # FastAPI Cloud CLI

    ## 0.3.1

    ### Fixes

    *  Fix login url not linked correctly.

    ### Refactors

    *  Refactor env vars creation.
    *  Remove env vars from deploy workflow.

    ### Internal

    *  Log files added to archive in debug mode.
    *  Add test to make sure .fastapicloudignore can override .gitignore.

    ## 0.3.0

    ### Features

    -  Add support for `.fastapicloudignore` file.

    ## 0.2.1

    ### Features

    *  Add support for verification statuses.

    ----

    ## `python-rignore`

    ### 0.7.1

    - Add support for overrides

    ### 0.7.0

    - Update PyO3 to 0.26

    ----

    # python-inline-snapshot

    ## 0.30.1  2025-10-20

    Fixed
    -----

    - Disable ensure ascii in json.dump to support non-ASCII characters in external files

    ## 0.30.0  2025-10-15

    Added
    -----

    - The `test-dir` config option can now also be a list of paths
    - added (official) Python 3.14 support

    ## 0.29.4  2025-10-13

    Changed
    -------

    - `External.run_inline()` now uses the same logic as `External.run_pytest`.

    Fixed
    -----

    - inline-snapshot now supports different Python file encodings and recognizes     encoding comments such as `# -*- coding: windows-1251 -*-`

    ## 0.29.3  2025-10-04

    Fixed
    -----

    - xdist is now detected properly.

    ## 0.29.2  2025-10-01

    Fixed
    -----

    - fixed string formatting with black which caused invalid snapshots


    ----

    ## rust-regex 1.11.3 (2025-09-25)

    This is a small patch release with an improvement in memory usage in some     cases.

    **Improvements:**

    * Improve memory usage by trimming excess memory capacity in some spots.

    ----

    ## rust-speedate 0.17.0

    - feat: add new from float with config func
    - Derive Copy on Date, Time and DateTime

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Update `rust-regex-automata` to 0.4.11
    - Update `rust-serde_json` to 1.0.145
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1
    - Update `python-pydantic-core` to 2.41.4
    - Update `openapi-python-client` to 0.26.2 and patch it to allow `ruff` 0.14 and `typer` 0.20
    - Initial package for `python-cron-converter`
    - Initial packages for a number of new Rust library dependencies for `ruff` and `uv`












Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-43a0bff5ea advisory.

    ## uv 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518.

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Initial package for `python-uv-build` in Fedora 42
    - Initial packages for a number of new dependencies for `ruff` and `uv`.
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1.
    - Patch `openapi-python-client` to allow `ruff` 0.14


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-a77c1f005b advisory.

    ## uv 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518.

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Initial package for `python-uv-build` in Fedora 42
    - Initial packages for a number of new dependencies for `ruff` and `uv`
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1
    - Update `openapi-python-client` to 0.26.2 and patch it to allow `ruff` 0.14

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1     , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing     in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing     denialofservice for endpoints serving files (e.g., StaticFiles or any use of FileResponse). This     vulnerability is fixed in 0.49.1. (CVE-2025-62727)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
274463	Fedora 42 : python-starlette (2025-4520cf6bac)	Nessus	Fedora Local Security Checks	high
274396	Fedora 41 : python-starlette (2025-10d2e6260b)	Nessus	Fedora Local Security Checks	high
272299	Fedora 43 : fastapi-cli / fastapi-cloud-cli / gherkin / maturin / etc (2025-4154ea83d0)	Nessus	Fedora Local Security Checks	high
272181	Fedora 41 : openapi-python-client / python-uv-build / ruff / etc (2025-43a0bff5ea)	Nessus	Fedora Local Security Checks	high
272180	Fedora 42 : openapi-python-client / python-uv-build / ruff / etc (2025-a77c1f005b)	Nessus	Fedora Local Security Checks	high
271968	Linux Distros Unpatched Vulnerability : CVE-2025-62727	Nessus	Misc.	high

Detections

Analytics

CVE-2025-62727

high

Tenable Plugins

high

high

high

high

high

high