{"id":"CVE-2026-48710","aliases":["ALPINE-CVE-2026-48710","CLSA-2026-1781052728","CLSA-2026-1789447406","CLSA-2026-1789648460","DEBIAN-CVE-2026-48710","EUVD-2026-32016","GHSA-86qp-5c8j-p5mr","MGASA-2026-0327","PYSEC-2026-161","ROOT-APP-PYPI-CVE-2026-48710","SUSE-SU-2026:22151-1","UBUNTU-CVE-2026-48710","X41-2026-002","openSUSE-SU-2026:11026-1","openSUSE-SU-2026:11044-1","openSUSE-SU-2026:20975-1"],"status":"published","title":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.70288,"percentile":0.99388,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-1289","CWE-444"],"published":"2026-05-22T13:10:03Z","modified":"2026-11-03T06:32:56Z","kev":{"date_added":"2026-09-02","due_date":"2026-09-16","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-09-02"},{"source":"kev","since":"2026-09-02"}],"exploits":[{"source":"pocgithub","id":"eris-ths/supply-chain-guard","title":"eris-ths/supply-chain-guard","date":"2026-04-01","url":"https://github.com/eris-ths/supply-chain-guard"},{"source":"pocgithub","id":"xtremebeing/starlette-host-header-lab","title":"xtremebeing/starlette-host-header-lab","date":"2026-05-27","url":"https://github.com/xtremebeing/starlette-host-header-lab"},{"source":"pocgithub","id":"Bhanunamikaze/BadHost-CVE-2026-48710-Exploit","title":"Bhanunamikaze/BadHost-CVE-2026-48710-Exploit","date":"2026-05-28","url":"https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit"},{"source":"pocgithub","id":"sb-ox/repro-OXDEV-77637-uv-workspace","title":"sb-ox/repro-OXDEV-77637-uv-workspace","date":"2026-08-03","url":"https://github.com/sb-ox/repro-OXDEV-77637-uv-workspace"},{"source":"pocgithub","id":"CuteeCat/CVE-2026-48710","title":"CuteeCat/CVE-2026-48710","date":"2026-08-11","url":"https://github.com/CuteeCat/CVE-2026-48710"},{"source":"nuclei","id":"CVE-2026-48710","title":"Starlette - Improper Validation of Unsafe Equivalence in Input","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48710.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"starlette","fixed_in":["1.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-starlette","fixed_in":["1.1.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"starlette","fixed_in":["0.27.0.post3+tuxcare","0.13.6.post6+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"starlette","fixed_in":["0.26.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"starlette","fixed_in":["0.46.1-3+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"starlette","fixed_in":["1.1.0-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"starlette","fixed_in":["0.27.0+aikido.11","0.22.0+aikido.7","0.19.0+aikido.1","0.19.1+aikido.1","0.21.0+aikido.1","0.27.0+aikido.1","0.36.1+aikido.1","0.36.2+aikido.1","0.45.3+aikido.10","0.45.3+aikido.11","0.45.3+aikido.5","0.45.3+aikido.6","0.45.3+aikido.7","0.45.3+aikido.8","0.45.3+aikido.9","0.9.9+aikido.1","0.38.6+aikido.1","0.45.0+aikido.1","0.9.9+aikido.2","0.45.1+aikido.1","0.47.0+aikido.3","0.49.2+aikido.1","0.45.2+aikido.2","0.49.3+aikido.1","0.44.0+aikido.1","0.43.0+aikido.1","0.46.0+aikido.2","0.41.0+aikido.1","0.51.0+aikido.1","0.52.0+aikido.1","0.38.5+aikido.1","0.49.0+aikido.1","0.38.4+aikido.1","0.38.2+aikido.1","0.22.0+aikido.3","0.47.2+aikido.2","0.47.1+aikido.2","0.41.2+aikido.2","0.41.3+aikido.2","0.41.3+aikido.3","0.47.2+aikido.3","0.47.1+aikido.3","0.41.3+aikido.5","0.41.3+aikido.6","0.49.3+aikido.3","0.46.2+aikido.6","0.45.3+aikido.13","0.52.1+aikido.2","0.49.1+aikido.2","0.49.2+aikido.3","0.48.0+aikido.5","0.47.3+aikido.5","0.45.3+aikido.14","0.49.3+aikido.4","0.49.2+aikido.4","0.41.3+aikido.7","0.46.2+aikido.7","0.52.1+aikido.3","0.22.0+aikido.5","0.49.1+aikido.3","1.0.0+aikido.3","0.45.3+aikido.15","0.50.0+aikido.3","0.22.0+aikido.6","0.27.0+aikido.10","0.37.2+aikido.2","0.39.2+aikido.2","0.13.1+aikido.1","0.13.8+aikido.1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-starlette","fixed_in":["0.22.0+aikido.4","0.21.0+aikido.2","0.19.0+aikido.2","0.19.1+aikido.2","0.41.3+aikido.4","0.43.0+aikido.2","0.44.0+aikido.2","0.45.0+aikido.2","0.47.2+aikido.4","0.45.3+aikido.12","0.45.1+aikido.2","0.46.0+aikido.3","0.47.1+aikido.4","0.47.0+aikido.4","0.49.1+aikido.1","0.49.2+aikido.2","0.49.3+aikido.2","0.49.0+aikido.2","0.51.0+aikido.2","0.52.0+aikido.2","0.9.9+aikido.3","0.52.1+aikido.1","0.45.2+aikido.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-starlette","fixed_in":["1.2.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-google-adk","fixed_in":["2.2.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.3"},{"fixed":"1.1.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.0"},{"fixed":"0.27.0.post3+tuxcare"}]}],"versions":["0.27.0","0.27.0.post1+tuxcare","0.27.0.post2+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"fixed":"0.25.0.post1+tuxcare"}]}],"versions":["0.25.0"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.6"},{"fixed":"0.13.6.post6+tuxcare"}]}],"versions":["0.13.6","0.13.6.post1+tuxcare","0.13.6.post2+tuxcare","0.13.6.post3+tuxcare","0.13.6.post4+tuxcare","0.13.6.post5+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-1+deb12u1"}]}],"versions":["0.26.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.1-3+deb13u2"}]}],"versions":["0.46.1-3","0.46.1-3+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1"}]}],"versions":["0.46.1-3","0.50.0-1","1.0.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.2.2","0.2.3","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.0","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.0-3.1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.2.2","0.2.3","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.0","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0+aikido.11"},{"fixed":"0.22.0+aikido.7"},{"fixed":"0.19.0+aikido.1"},{"fixed":"0.19.1+aikido.1"},{"fixed":"0.21.0+aikido.1"},{"fixed":"0.27.0+aikido.1"},{"fixed":"0.36.1+aikido.1"},{"fixed":"0.36.2+aikido.1"},{"fixed":"0.45.3+aikido.10"},{"fixed":"0.45.3+aikido.11"},{"fixed":"0.45.3+aikido.5"},{"fixed":"0.45.3+aikido.6"},{"fixed":"0.45.3+aikido.7"},{"fixed":"0.45.3+aikido.8"},{"fixed":"0.45.3+aikido.9"},{"fixed":"0.9.9+aikido.1"},{"fixed":"0.38.6+aikido.1"},{"fixed":"0.45.0+aikido.1"},{"fixed":"0.9.9+aikido.2"},{"fixed":"0.45.1+aikido.1"},{"fixed":"0.47.0+aikido.3"},{"fixed":"0.49.2+aikido.1"},{"fixed":"0.45.2+aikido.2"},{"fixed":"0.49.3+aikido.1"},{"fixed":"0.44.0+aikido.1"},{"fixed":"0.43.0+aikido.1"},{"fixed":"0.46.0+aikido.2"},{"fixed":"0.41.0+aikido.1"},{"fixed":"0.51.0+aikido.1"},{"fixed":"0.52.0+aikido.1"},{"fixed":"0.38.5+aikido.1"},{"fixed":"0.49.0+aikido.1"},{"fixed":"0.38.4+aikido.1"},{"fixed":"0.38.2+aikido.1"},{"fixed":"0.22.0+aikido.3"},{"fixed":"0.47.2+aikido.2"},{"fixed":"0.47.1+aikido.2"},{"fixed":"0.41.2+aikido.2"},{"fixed":"0.41.3+aikido.2"},{"fixed":"0.41.3+aikido.3"},{"fixed":"0.47.2+aikido.3"},{"fixed":"0.47.1+aikido.3"},{"fixed":"0.41.3+aikido.5"},{"fixed":"0.41.3+aikido.6"},{"fixed":"0.49.3+aikido.3"},{"fixed":"0.46.2+aikido.6"},{"fixed":"0.45.3+aikido.13"},{"fixed":"0.52.1+aikido.2"},{"fixed":"0.49.1+aikido.2"},{"fixed":"0.49.2+aikido.3"},{"fixed":"0.48.0+aikido.5"},{"fixed":"0.47.3+aikido.5"},{"fixed":"0.45.3+aikido.14"},{"fixed":"0.49.3+aikido.4"},{"fixed":"0.49.2+aikido.4"},{"fixed":"0.41.3+aikido.7"},{"fixed":"0.46.2+aikido.7"},{"fixed":"0.52.1+aikido.3"},{"fixed":"0.22.0+aikido.5"},{"fixed":"0.49.1+aikido.3"},{"fixed":"1.0.0+aikido.3"},{"fixed":"0.45.3+aikido.15"},{"fixed":"0.50.0+aikido.3"},{"fixed":"0.22.0+aikido.6"},{"fixed":"0.27.0+aikido.10"},{"fixed":"0.37.2+aikido.2"},{"fixed":"0.39.2+aikido.2"},{"fixed":"0.13.1+aikido.1"},{"fixed":"0.13.8+aikido.1"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0+aikido.4"},{"fixed":"0.21.0+aikido.2"},{"fixed":"0.19.0+aikido.2"},{"fixed":"0.19.1+aikido.2"},{"fixed":"0.41.3+aikido.4"},{"fixed":"0.43.0+aikido.2"},{"fixed":"0.44.0+aikido.2"},{"fixed":"0.45.0+aikido.2"},{"fixed":"0.47.2+aikido.4"},{"fixed":"0.45.3+aikido.12"},{"fixed":"0.45.1+aikido.2"},{"fixed":"0.46.0+aikido.3"},{"fixed":"0.47.1+aikido.4"},{"fixed":"0.47.0+aikido.4"},{"fixed":"0.49.1+aikido.1"},{"fixed":"0.49.2+aikido.2"},{"fixed":"0.49.3+aikido.2"},{"fixed":"0.49.0+aikido.2"},{"fixed":"0.51.0+aikido.2"},{"fixed":"0.52.0+aikido.2"},{"fixed":"0.9.9+aikido.3"},{"fixed":"0.52.1+aikido.1"},{"fixed":"0.45.2+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.1-1","0.16.0-1","0.18.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.0-1","0.31.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.46.1-2","0.46.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.0-1","1.1.0-1","1.3.1-1","1.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.46.1-3","0.50.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-google-adk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.3.1"}]}],"bundled":3}],"products":[{"vendor":"encode","product":"starlette"},{"vendor":"kludex","product":"starlette"},{"vendor":"red hat","product":"exploit intelligence"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.7"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat migration toolkit for applications 8.2"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat satellite 6.17"},{"vendor":"red hat","product":"red hat satellite 6.18"},{"vendor":"red hat","product":"red hat satellite 6.19"},{"vendor":"redhat","product":"ai_inference_server"},{"vendor":"redhat","product":"ansible_automation_platform"},{"vendor":"redhat","product":"enterprise_linux_ai"},{"vendor":"redhat","product":"migration_toolkit_for_applications"},{"vendor":"redhat","product":"openshift_ai"},{"vendor":"redhat","product":"openshift_lightspeed"},{"vendor":"redhat","product":"satellite"}],"references":[{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","evidence","report"]},{"url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://badhost.org","tags":["x_refsource_MISC","Mitigation","Third Party Advisory","web","article","detection"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml","tags":["x_refsource_MISC","Third Party Advisory","advisory","web"]},{"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette","tags":["x_refsource_MISC","Mitigation","Third Party Advisory","web"]},{"url":"https://www.secwest.net/starlette","tags":["x_refsource_MISC","Exploit","Mitigation","Third Party Advisory","web","article"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette","tags":["x_refsource_MISC","Exploit","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https:/www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points","tags":["third-party-advisory","Broken Link","advisory"]},{"url":"https://www.wiz.io/blog/ai-infrastructure-honeypot","tags":["third-party-advisory","Exploit","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710","tags":["government-resource","Third Party Advisory","US Government Resource","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48710","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","tags":["x_sadp-csaf-vex","Third Party Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23346","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43038","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34456","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44696","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22993","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26226","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51357","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22992","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34532","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34526","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63337","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48710","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-86qp-5c8j-p5mr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-48710","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48710.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48710","tags":["advisory"]},{"url":"https://github.com/Kludex/starlette","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0327.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35637","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWLLKAJQCNBN46LPLDAYBM2FU65WBX72/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00213.html","tags":["web"]},{"url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FET4KWO46IN64G35ZF7HGJJBIM4OF3YC/","tags":["web"]},{"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/","tags":["article"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622151-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246855","tags":["report"]},{"url":"https://bugzilla.suse.com/1252805","tags":["report"]},{"url":"https://bugzilla.suse.com/1266369","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48710","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-48710","tags":["report"]},{"url":"https://x41-dsec.de/lab/advisories/x41-2026-002-starlette/","tags":["report"]},{"url":"https://github.com/Kludex/starlette/pull/3279","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-48710","title":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-05-26T21:54:54.393Z","modified":"2026-10-01T17:41:26.242Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-444","CWE-1289"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-32016","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-05-26T21:54:54Z","modified":"2026-10-01T17:41:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2026-09-02","updated_at":"2026-11-02T17:27:44.322377Z"}],"ghsa":[{"id":"GHSA-86qp-5c8j-p5mr","title":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","description":"### Summary\nIn affected versions, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed.\n\n### Details\nWhen a client requests `http://example.com/foo`, it sends:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com\n```\n\nAffected versions reconstructed the URL by concatenating `http://{host}{path}` and re-parsing the result. The `Host` value is only valid as a `uri-host [ \":\" port ]` per [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6), where `uri-host` follows the restricted `host` grammar of [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2). When it contains characters outside that grammar - notably `/`, `?`, or `#` - those characters move the path/query/fragment boundaries during re-parsing, so the parsed `request.url.path` no longer matches the path the server actually received. For example:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com/abc?bar=\n```\n\nreconstructs to `http://example.com/abc?bar=/foo`, whose parsed `path` is `/abc` - even though routing used the real path `/foo`. The router still dispatches to `/foo` and the endpoint executes, but any middleware or code that reads `request.url.path` sees `/abc`, so path-based authorization checks can be bypassed.\n\n### Impact\nAny application running an affected version that relies on `request.url` (or `request.url.path`) for security-sensitive decisions is affected. The most common case is middleware that gates access to certain path prefixes based on `request.url.path`. Deployments fronted by a proxy or load balancer are mitigated only if that proxy rejects or normalizes the malformed `Host` header before forwarding and the application does not trust attacker-controlled host headers (e.g. `X-Forwarded-Host`) elsewhere.\n\n### Mitigation\nUpgrade to a patched version, which validates the `Host` header against the grammar of [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6) / [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2) when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-06-04T13:15:17Z","modified":"2026-08-28T18:31:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444","CWE-1289"],"updated_at":"2026-11-02T14:41:08.084849Z"}],"kev":[{"id":"CVE-2026-48710","title":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability","description":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.","cwes":["CWE-444"],"kev":{"date_added":"2026-09-02","due_date":"2026-09-16","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-48710","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-05-26T22:16:44.02Z","modified":"2026-10-01T18:17:18.153Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-444","CWE-1289"],"updated_at":"2026-11-02T14:12:20.511562Z"}],"osv":[{"id":"ALPINE-CVE-2026-48710","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-05-26T22:16:44.02Z","modified":"2026-11-03T06:32:56.010555165Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-48710","title":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-05-26T21:54:54.393Z","modified":"2026-10-28T02:30:39.870544256Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"DEBIAN-CVE-2026-48710","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-05-26T22:16:44.02Z","modified":"2026-10-02T08:47:22.542172901Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-86qp-5c8j-p5mr","title":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","description":"### Summary\nIn affected versions, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed.\n\n### Details\nWhen a client requests `http://example.com/foo`, it sends:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com\n```\n\nAffected versions reconstructed the URL by concatenating `http://{host}{path}` and re-parsing the result. The `Host` value is only valid as a `uri-host [ \":\" port ]` per [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6), where `uri-host` follows the restricted `host` grammar of [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2). When it contains characters outside that grammar - notably `/`, `?`, or `#` - those characters move the path/query/fragment boundaries during re-parsing, so the parsed `request.url.path` no longer matches the path the server actually received. For example:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com/abc?bar=\n```\n\nreconstructs to `http://example.com/abc?bar=/foo`, whose parsed `path` is `/abc` - even though routing used the real path `/foo`. The router still dispatches to `/foo` and the endpoint executes, but any middleware or code that reads `request.url.path` sees `/abc`, so path-based authorization checks can be bypassed.\n\n### Impact\nAny application running an affected version that relies on `request.url` (or `request.url.path`) for security-sensitive decisions is affected. The most common case is middleware that gates access to certain path prefixes based on `request.url.path`. Deployments fronted by a proxy or load balancer are mitigated only if that proxy rejects or normalizes the malformed `Host` header before forwarding and the application does not trust attacker-controlled host headers (e.g. `X-Forwarded-Host`) elsewhere.\n\n### Mitigation\nUpgrade to a patched version, which validates the `Host` header against the grammar of [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6) / [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2) when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-06-04T13:15:17Z","modified":"2026-09-10T03:51:08.121685407Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-1289","CWE-444"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"UBUNTU-CVE-2026-48710","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","status":"published","published":"2026-05-26T22:16:00Z","modified":"2026-10-17T12:58:31.315530205Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1781052728","title":"TuxCare security update for starlette (1 CVE)","description":"TuxCare rebuilt starlette to address 1 CVE. Fixed in 0.27.0.post3+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:00.983715968Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1789447406","title":"TuxCare security update for starlette (8 CVEs)","description":"TuxCare rebuilt starlette to address 8 CVEs. Fixed in 0.25.0.post1+tuxcare.","status":"published","published":"2026-09-15T04:43:26Z","modified":"2026-10-15T09:48:01.789333066Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789648460","title":"TuxCare security update for starlette (1 CVE)","description":"TuxCare rebuilt starlette to address 1 CVE. Fixed in 0.13.6.post6+tuxcare.","status":"published","published":"2026-09-17T12:34:20Z","modified":"2026-10-15T09:48:01.793343869Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"MGASA-2026-0327","title":"Updated python-starlette package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nProxy-Authorization header kept across hosts. (CVE-2024-28849)\nStarlette vulnerable to O(n^2) DoS via Range header merging in\nstarlette.responses.FileResponse. (CVE-2025-62727)\nSecurity restriction bypass via malformed HTTP Host header.\n(CVE-2026-48710)\n","status":"published","published":"2026-08-09T06:02:53Z","modified":"2026-08-09T06:15:05.185054852Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11026-1","title":"python311-starlette-1.2.0-1.1 on GA media","description":"These are all security issues fixed in the python311-starlette-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-13T00:00:00Z","modified":"2026-06-14T14:00:06.141517112Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11044-1","title":"python311-google-adk-2.2.0-1.1 on GA media","description":"These are all security issues fixed in the python311-google-adk-2.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-06-17T09:15:08.104686579Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20975-1","title":"Security update for python-starlette","description":"This update for python-starlette fixes the following issues\n\n- CVE-2025-54121: denial-of-service when parsing a multi-part form with large files (bsc#1246855).\n- CVE-2025-62727: DoS via Range header merging (bsc#1252805).\n- CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassing path-based security checks\n  (bsc#1266369).\n","status":"published","published":"2026-06-17T08:36:30Z","modified":"2026-06-24T18:24:21.192210178Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"PYSEC-2026-161","title":"BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks","description":"Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path.","status":"published","published":"2026-05-22T13:10:03Z","modified":"2026-05-26T15:41:31.112064345Z","updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"ROOT-APP-PYPI-CVE-2026-48710","title":"CVE-2026-48710 in starlette - Patched by Root","description":"Root has patched CVE-2026-48710 in the starlette package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-02T16:36:01Z","modified":"2026-11-02T17:15:03.011644874Z","updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"SUSE-SU-2026:22151-1","title":"Security update for python-starlette","description":"This update for python-starlette fixes the following issues\n\n- CVE-2025-54121: denial-of-service when parsing a multi-part form with large files (bsc#1246855).\n- CVE-2025-62727: DoS via Range header merging (bsc#1252805).\n- CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassing path-based security checks\n  (bsc#1266369).\n","status":"published","published":"2026-06-17T08:36:56Z","modified":"2026-06-24T18:24:16.488365952Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}