Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks (Kludex starlette)

CVE-2026-48710

MEDIUM 6.5CISA KEV ↗Exploitée selon l'ENISA depuis le 2026-09-02

En bref

Source: NVD
EPSS: EPSS 70.29 % · centile 99 (2026-10-31)
État: PUBLISHED
Publiée: 2026-05-26 21:54 UTC
Mise à jour: 2026-10-01 17:41 UTC
Attribuée par: GitHub_M
Statut NVD: Analyzed

Rechercher sur…

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Faiblesses (CWE)

CWE-444 — Dissimulation de requête ou de réponse HTTP
CWE-1289 — Improper Validation of Unsafe Equivalence in Input

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	GitHub_M
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	redhat-SADP
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Avis

GHSA-86qp-5c8j-p5mr — Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
PYSEC-2026-161 — BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks

Références européennes

ENISA EUVD · EUVD-2026-32016
GCVE · GCVE-0-2026-48710

Avis du CERT-FR

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* ≥ 0.8.3 < 1.0.1
cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:* ≥ 3.3.0 ≤ 3.3.5
cpe:2.3:a:redhat:ansible_automation_platform:2.6:-:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_automation_platform:2.7:-:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_applications:*:*:*:*:*:*:*:* < 8.2.0
cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:* ≥ 3.3 < 3.3.5
cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:* ≥ 3.4 < 3.4.2
cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.17:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.19:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_ai:3.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Kludex · starlette	affected < 1.0.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks (Kludex starlette)