{"cve":"CVE-2026-48710","nvd":{"published":"2026-05-26T22:16:44.020","modified":"2026-10-01T18:17:18.153","status":"Analyzed","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cwes":["CWE-444","CWE-1289"],"references":["https://badhost.org","https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6","https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml","https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"],"products":["encode:starlette","redhat:ai_inference_server","redhat:ansible_automation_platform","redhat:enterprise_linux_ai","redhat:migration_toolkit_for_applications","redhat:openshift_ai","redhat:openshift_lightspeed","redhat:satellite"],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-48710","score":0.70288,"percentile":0.99379,"date":"2026-10-25"},"kev":{"cve":"CVE-2026-48710","date_added":"2026-09-02","due_date":"2026-09-16","vendor":"Kludex","product":"Starlette","known_ransomware":false},"osv":[{"id":"GHSA-86qp-5c8j-p5mr","url":"https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr","summary":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","modified":"2026-09-10T03:51:08.121685407Z","packages":[{"ecosystem":"PyPI","name":"starlette","purl":"pkg:pypi/starlette","ranges":["<1.0.1"],"fixed":["1.0.1"]}]},{"id":"PYSEC-2026-161","url":"https://osv.dev/vulnerability/PYSEC-2026-161","summary":"BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks","modified":"2026-05-26T15:41:31.112064345Z","packages":[{"ecosystem":"PyPI","name":"starlette","purl":"pkg:pypi/starlette","ranges":["<1.0.1"],"fixed":["1.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}