CVE-2026-48710

Name of the Vulnerable Software and Affected Versions Starlette versions prior to 1.0.1

Description Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework, fails to validate the HTTP Host request header before using it to reconstruct request.url. While the routing algorithm uses the raw HTTP path, request.url is rebuilt using the Host header. An attacker can send a specially crafted Host header containing characters such as /, ?, or # to shift path, query, or fragment boundaries during re-parsing. This causes request.url.path to differ from the actual requested path. Consequently, middleware or endpoints that enforce security restrictions based on request.url (instead of the raw scope path) can be bypassed, potentially allowing unauthorized access to protected endpoints.

Recommendations Upgrade to version 1.0.1 or later. As a temporary workaround, use request.scope["path"] instead of request.url.path for security-sensitive decisions. Restrict or normalize the Host header at the reverse proxy or load balancer level before it reaches the application.