# litestar (PyPI) vulnerabilities 8 known vulnerabilities (5 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.25.0 (Oct 18, 2026): no advisory affects it - Newest unaffected release: 2.25.0 (Oct 18, 2026), the latest release - Weekly downloads: 403.9K - Dependents: 182 - Releases: 66 since 2.0.0 (Aug 21, 2023) - Registry: https://pypi.org/project/litestar/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-48061: 1.0.0a0 to 2.21.1 (2.22.0 is outside it) - CVE-2026-48060: 1.0.0a0 to 2.21.1 (2.22.0 is outside it) - CVE-2026-25480: 1.0.0a0 to 2.19.0 (2.20.0 is outside it) - CVE-2026-25479: 1.0.0a0 to 2.19.0 (2.20.0 is outside it) - CVE-2026-25478: 1.0.0a0 to 2.19.0 (2.20.0 is outside it) - CVE-2025-59152: 2.17.0 (2.18.0 is outside it) - CVE-2024-52581: 1.0.0a0 to 2.12.1 (2.13.0 is outside it) - CVE-2024-32982: 2.0.0 to 2.6.3 (2.6.4 is outside it); 2.7.0 to 2.7.1 (2.7.2 is outside it); 2.8.0 to 2.8.2 (2.8.3 is outside it) ## Advisories (8) ### [CVE-2026-48061](https://cve.now/CVE-2026-48061): Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header - Severity: Medium 5.9 - Published: Aug 3, 2026 - Affected: fixed in 2.22.0. - Fixed in 2.22.0 (released May 20, 2026, 75 days before disclosure). - The latest release, 2.25.0, is not affected. ### [CVE-2026-48060](https://cve.now/CVE-2026-48060): Litestar: HTML Injection Through CSRF Token - Severity: High 8.1 - Published: Jul 28, 2026 - Affected: fixed in 2.22.0. - Fixed in 2.22.0 (released May 20, 2026, 69 days before disclosure). - The latest release, 2.25.0, is not affected. ### [CVE-2026-25480](https://cve.now/CVE-2026-25480): FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD) - Severity: Medium 6.5 - Published: Feb 9, 2026 - Affected: fixed in 2.20.0; from 2.19.0, fixed in 2.20.0. - Fixed in 2.20.0 (released Feb 8, 2026, 1 day before disclosure). - The latest release, 2.25.0, is not affected. ### [CVE-2026-25479](https://cve.now/CVE-2026-25479): Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns - Severity: Medium 6.5 - Published: Feb 9, 2026 - Affected: fixed in 2.20.0; from 2.19.0, fixed in 2.20.0. - Fixed in 2.20.0 (released Feb 8, 2026, 1 day before disclosure). - The latest release, 2.25.0, is not affected. ### [CVE-2026-25478](https://cve.now/CVE-2026-25478): Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins - Severity: High 7.4 - Published: Feb 9, 2026 - Affected: from 2.19.0, fixed in 2.20.0; fixed in 2.20.0. - Fixed in 2.20.0 (released Feb 8, 2026, 1 day before disclosure). - The latest release, 2.25.0, is not affected. ### [CVE-2025-59152](https://cve.now/CVE-2025-59152): X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting - Severity: High 7.5 - Published: Oct 6, 2025 - Affected: from 2.17.0, fixed in 2.18.0. - Fixed in 2.18.0 (released Oct 5, 2025, 1 day before disclosure). - The latest release, 2.25.0, is not affected. ### [CVE-2024-52581](https://cve.now/CVE-2024-52581): Litestar allows unbounded resource consumption (DoS vulnerability) - Severity: High 8.2 - Published: Nov 20, 2024 - Affected: fixed in 2.13.0; fixed in 2.13.0. - Fixed in 2.13.0 (released Nov 20, 2024, the day of disclosure). - The latest release, 2.25.0, is not affected. ### [CVE-2024-32982](https://cve.now/CVE-2024-32982): Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - Severity: High 8.2 - Published: May 6, 2024 - Affected: from 2.8.0, fixed in 2.8.3; from 2.7.0, fixed in 2.7.2; from 2.0.0, fixed in 2.6.4; from 2.0.0, fixed in 2.6.4; from 2.7.0, fixed in 2.7.2; from 2.8.0, fixed in 2.8.3. - Fixed in 2.6.4 (released May 6, 2024, the day of disclosure), 2.7.2 (released May 6, 2024, the day of disclosure) and 2.8.3 (released May 6, 2024, the day of disclosure). - The latest release, 2.25.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/litestar Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.