Skip to contentLitestar-org Litestar vulnerabilities
- litestar-org litestarLitestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerCVE-2026-48061Fix available5.9 Medium
- litestar-org litestarLitestar: HTML Injection Through CSRF TokenCVE-2026-48060Public exploitFix available8.1 High
- litestarFileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)CVE-2026-25480Fix available6.5 Medium
- litestarLitestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patternsCVE-2026-25479Fix available6.5 Medium
- litestarLitestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed originsCVE-2026-25478Fix available7.4 High
- litestar-org litestarX-Forwarded-For Header Spoofing Bypasses Litestar Rate LimitingCVE-2025-59152Fix available7.5 High
- litestarLitestar allows unbounded resource consumption (DoS vulnerability)CVE-2024-52581Fix available8.2 High
- litestar-org litestarLitestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflowCVE-2024-42370Public exploit8.3 High
- litestar-org litestar, starliteproject starlite +1 moreLitestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-32982Fix available8.2 High