PyPIPackage

litestar

8 known vulnerabilities (5 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 2.25.0 (Oct 18, 2026): no advisory affects it
Newest unaffected release: 2.25.0 (Oct 18, 2026), the latest release
Advisories: 8 · 5 high, 3 medium

Weekly downloads: 403.9K
Dependents: 182
Releases: 66 since 2.0.0 (Aug 21, 2023)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-48061
Affects 1.0.0a0 to 2.21.1 (2.22.0 is outside it)
CVE-2026-48060
Affects 1.0.0a0 to 2.21.1 (2.22.0 is outside it)
CVE-2026-25480
Affects 1.0.0a0 to 2.19.0 (2.20.0 is outside it)
CVE-2026-25479
Affects 1.0.0a0 to 2.19.0 (2.20.0 is outside it)
CVE-2026-25478
Affects 1.0.0a0 to 2.19.0 (2.20.0 is outside it)
CVE-2025-59152
Affects 2.17.0 (2.18.0 is outside it)
CVE-2024-52581
Affects 1.0.0a0 to 2.12.1 (2.13.0 is outside it)
CVE-2024-32982
Affects 2.0.0 to 2.6.3 (2.6.4 is outside it); 2.7.0 to 2.7.1 (2.7.2 is outside it); 2.8.0 to 2.8.2 (2.8.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-48061Medium 5.9
Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Affected: fixed in 2.22.0.
Fixed in 2.22.0 (released May 20, 2026, 75 days before disclosure).
The latest release, 2.25.0, is not affected.
CVE-2026-48060High 8.1
Litestar: HTML Injection Through CSRF Token
Affected: fixed in 2.22.0.
Fixed in 2.22.0 (released May 20, 2026, 69 days before disclosure).
The latest release, 2.25.0, is not affected.
CVE-2026-25480Medium 6.5
FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Affected: fixed in 2.20.0; from 2.19.0, fixed in 2.20.0.
Fixed in 2.20.0 (released Feb 8, 2026, 1 day before disclosure).
The latest release, 2.25.0, is not affected.
CVE-2026-25479Medium 6.5
Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns
Affected: fixed in 2.20.0; from 2.19.0, fixed in 2.20.0.
Fixed in 2.20.0 (released Feb 8, 2026, 1 day before disclosure).
The latest release, 2.25.0, is not affected.
CVE-2026-25478High 7.4
Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins
Affected: from 2.19.0, fixed in 2.20.0; fixed in 2.20.0.
Fixed in 2.20.0 (released Feb 8, 2026, 1 day before disclosure).
The latest release, 2.25.0, is not affected.
CVE-2025-59152High 7.5
X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting
Affected: from 2.17.0, fixed in 2.18.0.
Fixed in 2.18.0 (released Oct 5, 2025, 1 day before disclosure).
The latest release, 2.25.0, is not affected.
CVE-2024-52581High 8.2
Litestar allows unbounded resource consumption (DoS vulnerability)
Affected: fixed in 2.13.0; fixed in 2.13.0.
Fixed in 2.13.0 (released Nov 20, 2024, the day of disclosure).
The latest release, 2.25.0, is not affected.
CVE-2024-32982High 8.2
Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected: from 2.8.0, fixed in 2.8.3; from 2.7.0, fixed in 2.7.2; from 2.0.0, fixed in 2.6.4; from 2.0.0, fixed in 2.6.4; from 2.7.0, fixed in 2.7.2; from 2.8.0, fixed in 2.8.3.
Fixed in 2.6.4 (released May 6, 2024, the day of disclosure), 2.7.2 (released May 6, 2024, the day of disclosure) and 2.8.3 (released May 6, 2024, the day of disclosure).
The latest release, 2.25.0, is not affected.