CVE-2026-48817

Name of the Vulnerable Software and Affected Versions Starlette versions 1.0.1 and earlier

Description In the HTTPEndpoint component, the handler is selected by lowercasing the HTTP method and looking it up as an attribute using getattr without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method, allowing any method to reach the endpoint. If a non-standard HTTP method is used whose lowercased name matches an attribute on the endpoint subclass, that attribute is invoked as a request handler. This allows an attacker to access methods not intended to be HTTP handlers, such as internal helpers, bypassing authorization checks applied to public handlers. This issue also affects frameworks built on Starlette, such as FastAPI.

Recommendations Update to version 1.1.0. Register HTTPEndpoint subclasses with an explicit methods= argument on the Route, listing only the supported HTTP verbs to ensure other methods are rejected with a 405 Method Not Allowed response.