Starlette CVE-2026-48710
MEDIUMCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 13 pypi packages depend on starlette (10 direct, 3 indirect)
Ecosystem-wide dependent count for version 1.0.1.
DescriptionNVD
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.
AnalysisAI
Host header injection in Starlette prior to version 1.0.1 allows unauthenticated remote attackers to cause request.url.path to differ from the actual ASGI scope path used for routing, enabling bypass of middleware and endpoint security controls that rely on request.url rather than the raw scope. Any application enforcing path-based ACLs, authentication gates, or WAF-style filters through request.url is affected, as a crafted Host header can make the URL appear to address a permitted path while the real route differs. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today