Kludex

**Name of the Vulnerable Software and Affected Versions** Starlette versions 1.0.1 and earlier **Description** In the `HTTPEndpoint` component, the handler is selected by lowercasing the HTTP method and looking it up as an attribute using `getattr` without restricting the lookup to a known set of HTTP verbs. When an `HTTPEndpoint` subclass is registered through `Route(...)` without an explicit `methods=` argument, the route does not constrain the method, allowing any method to reach the endpoint. If a non-standard HTTP method is used whose lowercased name matches an attribute on the endpoint subclass, that attribute is invoked as a request handler. This allows an attacker to access methods not intended to be HTTP handlers, such as internal helpers, bypassing authorization checks applied to public handlers. This issue also affects frameworks built on Starlette, such as FastAPI. **Recommendations** Update to version 1.1.0. Register `HTTPEndpoint` subclasses with an explicit `methods=` argument on the `Route`, listing only the supported HTTP verbs to ensure other methods are rejected with a 405 Method Not Allowed response.