{"id":"CVE-2026-48061","title":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework","summary":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whiteli…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-644","CWE-348","CWE-807"],"vendor":"litestar","product":"litestar","affected":["litestar < 2.22.0"],"patched":["litestar 2.22.0"],"published":"2026-08-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:37:00.427","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48061","references":[{"url":"https://github.com/litestar-org/litestar/commit/6930a20ceb543912cd651b42deae5b9f3637a262","label":"security-advisories@github.com"},{"url":"https://github.com/litestar-org/litestar/security/advisories/GHSA-3qmc-cj7q-62hv","label":"security-advisories@github.com"},{"url":"https://github.com/litestar-org/litestar/security/advisories/GHSA-3qmc-cj7q-62hv","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-3qmc-cj7q-62hv"}],"tags":["nvd","ghsa","pip"],"epss":0.00342,"epssPercentile":0.27683,"aliases":["GHSA-3qmc-cj7q-62hv"],"ecosystem":"pip","ingestedAt":"2026-07-07T15:41:59.546Z","slug":"CVE-2026-48061","body":"## Overview\n\nLitestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that strips X-Forwarded-Host, or when accepting HTTP/1.0 connections. This issue has been fixed in version 2.22.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48061)\n\nAffected packages:\n\n- `litestar < 2.22.0`\n\nPatched in:\n\n- `litestar 2.22.0`\n\nSource: https://github.com/advisories/GHSA-3qmc-cj7q-62hv","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}