Kludex Starlette vulnerabilities

• encode starlette Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS CVE-2026-54283 Fix available 7.5 HighJune 15, 2026
• encode starlette Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname CVE-2026-54282 Fix available 3.7 LowJune 15, 2026
• encode starlette, red hat exploit intelligence, migration toolkit for applications 8 +8 more +10 more Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows CVE-2026-48818 Fix available 7.5 HighJune 15, 2026
• encode starlette Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` CVE-2026-48817 Fix available 5.3 MediumJune 15, 2026
• encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 more Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-48710 In KEVPublic exploitFix available EPSS 70.3% 6.5 MediumMay 22, 2026
• encode starlette Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse CVE-2025-62727 Public exploitFix available 7.5 HighOctober 28, 2025