{"id":"CVE-2026-48710","title":"Starlette is a lightweight ASGI framework/toolkit","summary":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-444","CWE-1289"],"published":"2026-05-26","updated":"2026-06-29","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710","references":[{"url":"https://badhost.org","label":"security-advisories@github.com"},{"url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6","label":"security-advisories@github.com"},{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","label":"security-advisories@github.com"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml","label":"security-advisories@github.com"},{"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette","label":"security-advisories@github.com"},{"url":"https://www.secwest.net/starlette","label":"security-advisories@github.com"},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:22992","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22993","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23346","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26226","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48710","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"},{"url":"https://github.com/Kludex/starlette"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"url":"https://access.redhat.com/errata/RHSA-2026:34532"},{"url":"https://access.redhat.com/errata/RHSA-2026:34526"},{"url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"url":"https://access.redhat.com/errata/RHSA-2026:69466"},{"url":"https://access.redhat.com/errata/RHSA-2026:69467"},{"url":"https://access.redhat.com/errata/RHSA-2026:69464"}],"tags":["nvd","kev","in-the-wild","exploit-available","osv","pip","csaf","vex","red-hat"],"epss":0.36257,"epssPercentile":0.98456,"ingestedAt":"2026-06-29T14:29:18.103Z","kev":true,"exploited":true,"kevDateAdded":"2026-09-02","kevDueDate":"2026-09-16","kevRansomware":false,"exploits":{"github":5,"githubRepos":["https://github.com/eris-ths/supply-chain-guard","https://github.com/xtremebeing/starlette-host-header-lab","https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit"],"nuclei":["CVE-2026-48710"],"checkedAt":"2026-09-21T15:29:15.138Z"},"exploitAvailable":true,"aliases":["GHSA-86qp-5c8j-p5mr","PYSEC-2026-161","X41-2026-002"],"ecosystem":"pip","vendor":"starlette","product":"starlette","affected":["starlette < 1.0.1"],"patched":["starlette 1.0.1"],"slug":"CVE-2026-48710","body":"## Overview\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48710)\n\nAffected packages:\n\n- `starlette < 1.0.1`\n\nPatched in:\n\n- `starlette 1.0.1`\n\nSource: https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr\n\n## Vendor advisories\n\n- **RHSA-2026:30089** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30089)\n- **RHSA-2026:30088** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30088)\n- **RHSA-2026:69466** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69466)\n- **RHSA-2026:69467** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69467)\n- **RHSA-2026:69464** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69464)\n- **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866)\n- **RHSA-2026:23346** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23346)\n- **RHSA-2026:43038** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43038)\n- **RHSA-2026:37275** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37275)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **RHSA-2026:34456** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34456)\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat AI Inference Server, OpenShift Lightspeed, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json)","depth":"midnight","depthScore":68,"depthScoreParts":{"impact":35.8,"likelihood":7.3,"exploitation":25,"ransomware":0},"changes":[{"seq":5272,"id":"CVE-2026-48710","ts":1788887259205,"field":"exploit_available","old":"false","new":"true"},{"seq":4155,"id":"CVE-2026-48710","ts":1788886375970,"field":"exploit_available","old":"true","new":"false"},{"seq":2923,"id":"CVE-2026-48710","ts":1788883041360,"field":"exploit_available","old":"false","new":"true"},{"seq":1952,"id":"CVE-2026-48710","ts":1788882444654,"field":"exploit_available","old":"true","new":"false"},{"seq":1040,"id":"CVE-2026-48710","ts":1788881879382,"field":"exploit_available","old":"false","new":"true"},{"seq":222,"id":"CVE-2026-48710","ts":1788556174733,"field":"epss","old":"0.11042","new":"0.36257"},{"seq":218,"id":"CVE-2026-48710","ts":1788469572455,"field":"epss","old":"0.02099","new":"0.11042"},{"seq":214,"id":"CVE-2026-48710","ts":1788382976793,"field":"exploited","old":"false","new":"true"},{"seq":213,"id":"CVE-2026-48710","ts":1788382976793,"field":"kev","old":"false","new":"true"}]}