Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 1.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: yes
- Technical impact: partial
Summary
Starlette, a lightweight Python framework for building web applications and APIs, is affected. A malformed HTTP Host header can cause the URL path that the application reads to differ from the path actually requested, so security checks based on that URL path can be bypassed.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: partial
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- Kludex starlette
fixed in 1.0.1
- starlettePyPI
fixed in 1.0.1
References 7
GitHub · Kludex/starlette
badhost.org
GitHub · pypa/advisory-database
secwest.net
x41-dsec.de
Questions about CVE-2026-48710
What does this mean?
Starlette did not validate the HTTP Host request header. A malformed Host header can make request.url.path differ from the real request path, so path-based security checks in middleware or endpoints can be bypassed.Source: github.com
Am I affected, and how do I check?
Starlette version 1.0.0 and earlier are affected, and the bug matters only if the application uses request.url or request.url.path in middleware or endpoints to make security decisions. To check your version, run pip show starlette or inspect the installed package version.Source: github.com
What should I do about it?
Upgrade Starlette to version 1.0.1 or later, which validates the Host header. If you cannot upgrade yet, use scope["path"] instead of request.url.path in middleware, since the ASGI scope path cannot be manipulated via the Host header.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-09-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data