CVE-2026-48710Medium· 6.5▾ Midnight⚠ Exploited in the wildPoC availableStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 35.8 · likelihood 7.3 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.4%
Federal remediation due Sep 16, 2026
1.4% → 36%
5 GitHub repos · Nuclei ×1
Added to the CISA catalog on Sep 2, 2026. Federal remediation due Sep 16, 2026. View catalog ↗
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
starlette < 1.0.1Patched in:
starlette 1.0.1Source: https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-69243High· 7.0AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2025-62727High· 7.5Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
CVE-2026-48817Medium· 5.3Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
CVE-2026-48818High· 7.5Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
CVE-2026-54282Low· 3.7Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname