CVE-2026-48710
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed.
Risk Assessment
An attacker can bypass security restrictions based on request.url, potentially leading to unauthorized access to resources or application functions.
Recommendation
Upgrade Starlette to version 1.0.1 or later, which validates the Host header according to RFC 9112 §3.2 / RFC 3986 §3.2.2.
Other vulnerabilities in Starlette
See all- CVE-2026-48818High
A vulnerability in Starlette 1.0.1 and earlier on Windows allows SSRF via UNC paths. When the server validates the path, it sends an SMB request to the attacker, leaking NTLMv2 credentials. The issue affects default follow_symlink=False deployments, including frameworks like FastAPI.
- CVE-2023-30798High
The vulnerability in the Starlette Python framework before version 0.25.0 allows an unauthenticated remote attacker to specify an arbitrary number of form fields or files, causing excessive memory usage and denial of service (DoS) of the HTTP service.
Original NVD description (English source)
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.