CVE-2026-48710

Aliases:PYSEC-2026-161GHSA-86qp-5c8j-p5mrX41-2026-002DEBIAN-CVE-2026-48710UBUNTU-CVE-2026-48710
Advisory lineage Upstream: 0 Downstream: 7
Analyzed
Published: 26 May 2026, 21:54
Last modified:03 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
38/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
11.04% MEDIUM
11% probability +9.20%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

26 May 2026, 21:54
Published
Vulnerability first disclosed
02 Sept 2026, 00:00
Added to CISA KEV
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
03 Sept 2026, 12:04
Last Modified
Vulnerability information updated
16 Sept 2026, 00:00
CISA Remediation Due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 11.04%• Percentile: 96%

Techniques & Countermeasures

  • CWE-444•Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

  • CWE-1289•Improper Validation of Unsafe Equivalence in Input

    The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Affected Systems

  • debian•starlette

    all | < 0.26.1-1+deb12u1 | < 0.46.1-3+deb13u2 | < 1.1.0-1

  • ubuntu•starlette

    all | all | all | all

  • encode•starlette

    ≥ 0.8.3, < 1.0.1

  • kludex•starlette

    < 1.0.1

  • PyPI•starlette

    < 1.0.1

  • redhat•ai_inference_server

    ≥ 3.3.0, ≤ 3.3.5

  • redhat•ansible_automation_platform

    2.6 | 2.7

  • redhat•enterprise_linux_ai

    3.0

  • redhat•migration_toolkit_for_applications

    < 8.2.0

  • redhat•openshift_ai

    ≥ 3.3, < 3.3.5 | ≥ 3.4, < 3.4.2

  • redhat•openshift_lightspeed

    na

  • redhat•satellite

    6.17 | 6.18 | 6.19

References (38)