{"id":"CVE-2026-48817","aliases":["CLSA-2026-1782867588","CLSA-2026-1789447406","CLSA-2026-1789537996","DEBIAN-CVE-2026-48817","EUVD-2026-37788","GHSA-x746-7m8f-x49c","MGASA-2026-0413","OESA-2026-3977","PYSEC-2026-2280","ROOT-APP-PYPI-CVE-2026-48817","SUSE-SU-2026:22360-1","UBUNTU-CVE-2026-48817","openSUSE-SU-2026:21053-1"],"status":"published","title":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00213,"percentile":0.1164,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470"],"published":"2026-06-15T20:16:05Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"PyPI","package":"starlette","fixed_in":["1.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"starlette","fixed_in":["0.26.1-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"starlette","fixed_in":["0.46.1-3+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"starlette","fixed_in":["1.1.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-starlette","fixed_in":["0.46.1-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-starlette","fixed_in":["0.50.0+root.io.2","0.45.3+root.io.14","0.49.3+root.io.4","0.49.2+root.io.4","0.41.3+root.io.7","0.46.2+root.io.7","0.52.1+root.io.3","1.0.0+root.io.2","1.0.1+root.io.2","0.49.1+root.io.3","1.0.0+root.io.3","0.45.3+root.io.15"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"starlette","fixed_in":["0.50.0+aikido.2","0.45.3+aikido.14","0.49.3+aikido.4","0.49.2+aikido.4","0.41.3+aikido.7","0.46.2+aikido.7","0.52.1+aikido.3","1.0.0+aikido.2","1.0.1+aikido.2","0.49.1+aikido.3","1.0.0+aikido.3","0.45.3+aikido.15","0.50.0+aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.0"},{"fixed":"0.27.0.post4+tuxcare"}]}],"versions":["0.27.0","0.27.0.post1+tuxcare","0.27.0.post2+tuxcare","0.27.0.post3+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"fixed":"0.25.0.post1+tuxcare"}]}],"versions":["0.25.0"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.13.6"},{"fixed":"0.13.6.post5+tuxcare"}]}],"versions":["0.13.6","0.13.6.post1+tuxcare","0.13.6.post2+tuxcare","0.13.6.post3+tuxcare","0.13.6.post4+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-1+deb12u2"}]}],"versions":["0.26.1-1","0.26.1-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.1-3+deb13u3"}]}],"versions":["0.46.1-3","0.46.1-3+deb13u1","0.46.1-3+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1"}]}],"versions":["0.46.1-3","0.50.0-1","1.0.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.2.2","0.2.3","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.0","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.1"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.0-3.2.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.1-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.2.2","0.2.3","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.0","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.50.0+root.io.2"},{"fixed":"0.45.3+root.io.14"},{"fixed":"0.49.3+root.io.4"},{"fixed":"0.49.2+root.io.4"},{"fixed":"0.41.3+root.io.7"},{"fixed":"0.46.2+root.io.7"},{"fixed":"0.52.1+root.io.3"},{"fixed":"1.0.0+root.io.2"},{"fixed":"1.0.1+root.io.2"},{"fixed":"0.49.1+root.io.3"},{"fixed":"1.0.0+root.io.3"},{"fixed":"0.45.3+root.io.15"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.50.0+aikido.2"},{"fixed":"0.45.3+aikido.14"},{"fixed":"0.49.3+aikido.4"},{"fixed":"0.49.2+aikido.4"},{"fixed":"0.41.3+aikido.7"},{"fixed":"0.46.2+aikido.7"},{"fixed":"0.52.1+aikido.3"},{"fixed":"1.0.0+aikido.2"},{"fixed":"1.0.1+aikido.2"},{"fixed":"0.49.1+aikido.3"},{"fixed":"1.0.0+aikido.3"},{"fixed":"0.45.3+aikido.15"},{"fixed":"0.50.0+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.1-1","0.16.0-1","0.18.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.0-1","0.31.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.46.1-2","0.46.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.0-1","1.1.0-1","1.3.1-1","1.7.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.46.1-3","0.50.0-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41.3-160000.4.1"}]}],"bundled":3}],"products":[{"vendor":"encode","product":"starlette"},{"vendor":"kludex","product":"starlette"}],"references":[{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/Kludex/starlette/releases/tag/1.1.0","tags":["x_refsource_MISC","Release Notes","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48817","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x746-7m8f-x49c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48817.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48817","tags":["advisory"]},{"url":"https://github.com/Kludex/starlette","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0413.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36224","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00389.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3977","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622360-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268389","tags":["report"]},{"url":"https://bugzilla.suse.com/1268517","tags":["report"]},{"url":"https://bugzilla.suse.com/1268520","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54283","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-48817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48817","tags":["report"]},{"url":"https://github.com/Kludex/starlette/pull/3286","tags":["report"]},{"url":"https://github.com/Kludex/starlette/commit/e3f972225adb1d84b80dba132f520cc24cb84229","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-48817","title":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","status":"published","published":"2026-06-17T19:48:03.441Z","modified":"2026-06-18T13:54:23.221Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-37788","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","status":"published","published":"2026-06-17T19:48:03Z","modified":"2026-06-18T13:54:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:36.672794Z"}],"ghsa":[{"id":"GHSA-x746-7m8f-x49c","title":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","description":"### Summary\n\nWhen dispatching a request, `HTTPEndpoint` selects the handler by lowercasing the HTTP method and looking it up as an attribute with `getattr`, without restricting the lookup to a known set of HTTP verbs.\n\nWhen an `HTTPEndpoint` subclass is registered through `Route(...)` without an explicit `methods=` argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler.\n\n### Details\n\n`HTTPEndpoint` uses the client-supplied method name to resolve an instance attribute, without validating it against the set of HTTP verbs the endpoint supports. A method such as `_DO_DELETE` therefore resolves an attribute like `_do_delete` and invokes it. Non-standard methods are valid [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#name-method) token methods, so an endpoint must not treat the method name as a trusted attribute selector.\n\n### Impact\n\nAn application is affected when all of the following hold:\n\n* It defines an `HTTPEndpoint` subclass and registers it via `Route(...)` without an explicit `methods=` argument.\n* The subclass defines additional methods whose names match a non-standard HTTP-method token shape and that accept a single `request` argument and return a response.\n\nThis also affects frameworks built on Starlette, like FastAPI.\n\n### Mitigation\n\nRegister `HTTPEndpoint` subclasses with an explicit `methods=` argument on the `Route`, listing only the HTTP verbs the endpoint supports. The route then rejects any other method with `405 Method Not Allowed` before it reaches the endpoint, so non-standard methods cannot resolve an attribute.","status":"published","published":"2026-06-15T20:16:05Z","modified":"2026-07-09T21:05:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:40:41.501474Z"}],"nvd":[{"id":"CVE-2026-48817","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","status":"published","published":"2026-06-17T20:17:22.427Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:12:24.544761Z"}],"osv":[{"id":"CVE-2026-48817","title":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","status":"published","published":"2026-06-17T19:48:03.441Z","modified":"2026-10-28T02:31:04.947398599Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"DEBIAN-CVE-2026-48817","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","status":"published","published":"2026-06-17T20:17:22.427Z","modified":"2026-10-26T11:47:27.331901708Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-x746-7m8f-x49c","title":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","description":"### Summary\n\nWhen dispatching a request, `HTTPEndpoint` selects the handler by lowercasing the HTTP method and looking it up as an attribute with `getattr`, without restricting the lookup to a known set of HTTP verbs.\n\nWhen an `HTTPEndpoint` subclass is registered through `Route(...)` without an explicit `methods=` argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler.\n\n### Details\n\n`HTTPEndpoint` uses the client-supplied method name to resolve an instance attribute, without validating it against the set of HTTP verbs the endpoint supports. A method such as `_DO_DELETE` therefore resolves an attribute like `_do_delete` and invokes it. Non-standard methods are valid [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#name-method) token methods, so an endpoint must not treat the method name as a trusted attribute selector.\n\n### Impact\n\nAn application is affected when all of the following hold:\n\n* It defines an `HTTPEndpoint` subclass and registers it via `Route(...)` without an explicit `methods=` argument.\n* The subclass defines additional methods whose names match a non-standard HTTP-method token shape and that accept a single `request` argument and return a response.\n\nThis also affects frameworks built on Starlette, like FastAPI.\n\n### Mitigation\n\nRegister `HTTPEndpoint` subclasses with an explicit `methods=` argument on the `Route`, listing only the HTTP verbs the endpoint supports. The route then rejects any other method with `405 Method Not Allowed` before it reaches the endpoint, so non-standard methods cannot resolve an attribute.","status":"published","published":"2026-06-15T20:16:05Z","modified":"2026-09-10T03:50:12.272722043Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"OESA-2026-3977","title":"python-starlette security update","description":"%{expand:\r\n\r\nSecurity Fix(es):\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.(CVE-2026-48817)","status":"published","published":"2026-09-20T13:23:45Z","modified":"2026-09-20T13:30:29.716138904Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"PYSEC-2026-2280","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","status":"published","published":"2026-06-17T20:17:22.427Z","modified":"2026-07-13T07:15:42.498495396Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-48817","description":"Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.","status":"published","published":"2026-06-17T20:17:00Z","modified":"2026-10-17T13:00:23.865511053Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1782867588","title":"TuxCare security update for starlette (2 CVEs)","description":"TuxCare rebuilt starlette to address 2 CVEs. Fixed in 0.27.0.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T09:48:05.175953098Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1789447406","title":"TuxCare security update for starlette (8 CVEs)","description":"TuxCare rebuilt starlette to address 8 CVEs. Fixed in 0.25.0.post1+tuxcare.","status":"published","published":"2026-09-15T04:43:26Z","modified":"2026-10-15T09:48:01.789333066Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789537996","title":"TuxCare security update for starlette (4 CVEs)","description":"TuxCare rebuilt starlette to address 4 CVEs. Fixed in 0.13.6.post5+tuxcare.","status":"published","published":"2026-09-16T05:53:16Z","modified":"2026-10-15T09:48:01.802525719Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0413","title":"Updated python-starlette package fixes security vulnerabilities","description":"Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via\n`getattr`. (CVE-2026-48817)\nUnvalidated request path concatenated into authority poisons\nrequest.url.hostname. (CVE-2026-54282)\n","status":"published","published":"2026-09-17T14:10:41Z","modified":"2026-09-17T14:15:02.602502957Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21053-1","title":"Security update for python-starlette","description":"This update for python-starlette fixes the following issues\n\n- CVE-2026-48817: arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` (bsc#1268389).\n- CVE-2026-54282: request path that lacks a leading forward slash can lead to request.url.hostname manipulation\n  (bsc#1268520).\n- CVE-2026-54283: urlencoded request body with an oversized data can lead to a denial of service (bsc#1268517).\n","status":"published","published":"2026-06-24T21:39:55Z","modified":"2026-06-30T18:24:37.951801192Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-PYPI-CVE-2026-48817","title":"CVE-2026-48817 in rootio-starlette - Patched by Root","description":"Root has patched CVE-2026-48817 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-08-03T10:35:24Z","modified":"2026-08-03T13:45:12.900426333Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2026:22360-1","title":"Security update for python-starlette","description":"This update for python-starlette fixes the following issues\n\n- CVE-2026-48817: arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` (bsc#1268389).\n- CVE-2026-54282: request path that lacks a leading forward slash can lead to request.url.hostname manipulation\n  (bsc#1268520).\n- CVE-2026-54283: urlencoded request body with an oversized data can lead to a denial of service (bsc#1268517).\n","status":"published","published":"2026-06-24T21:41:06Z","modified":"2026-07-02T18:24:12.84134627Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}