CVE-2026-54282

Name of the Vulnerable Software and Affected Versions starlette versions prior to 1.3.1

Description The HTTP request path is not validated before being used to reconstruct request.url. When a path does not begin with /, such as @google.com, it is concatenated as {scheme}://{host}{path}. This shifts the authority boundary during re-parsing, causing request.url.hostname and request.url.netloc to be controlled by an attacker. Consequently, applications using these variables for security-sensitive decisions—such as host-based authorization, SSRF targets, or cache keys—can be misled into trusting an attacker-supplied host. This issue requires an ASGI server that forwards a request-target lacking a leading / into scope["path"]. The impact is primarily limited to middleware or 404/exception handlers, as the malformed path typically does not match registered routes.

Recommendations Upgrade to version 1.3.1 or newer.