6.5

CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability

CVSS: 6.5v3.1MediumKEVAnalyzed
AliasesGHSA-86qp-5c8j-p5mrPYSEC-2026-161X41-2026-002
Published 26-05-2026Last modified 01-10-2026
Open JSON

Vulnerability summary

CVE-2026-48710 is a medium (CVSS 6.5) HTTP Request/Response Smuggling vulnerability in Kludex Starlette. It is known to be exploited: CISA lists it, first on 02-09-2026. EPSS estimates a 7.06% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
7.06%
0%100%
Low · -29.20 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
MGASA-2026-0327OPENSUSE-SU-2026:20975-1SUSE-SU-2026:22151-1CGA-VXHX-M86X-8C2H

Timeline

  1. 26-05-2026
    PublishedVulnerability first disclosed.
  2. 02-09-2026
    Added to CISA KEVKludex Starlette HTTP Request/Response Smuggling Vulnerability
  3. 16-09-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 01-10-2026
    Last modifiedVulnerability information updated.

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

7.06%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

-29.20 pp

From 36.26% on 19-09-2026

19-09-202619-10-2026
EPSS score
7.06%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
02-09-2026
Federal due date
16-09-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. nvd.nist.gov/vuln/detail/CVE-2026-48710

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (secwest.net)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (x41-dsec.de)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (wiz.io)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Chainguard10 products
  • keep-apiAll versions (No fix recorded)
  • keep-api-fipsAll versions (No fix recorded)
  • mlflow< 3.16.0-r0
  • mlrun-apiAll versions (No fix recorded)
  • mlrun-api-fipsAll versions (No fix recorded)
Redhat7 products
Opensuse2 products
  • python-google-adk&distro=openSUSE Tumbleweed< 2.2.0-1.1
  • python-starlette&distro=openSUSE Tumbleweed< 1.2.0-1.1
Debian1 product
  • starlette< 0.26.1-1+deb12u1 | < 0.46.1-3+deb13u2 | < 1.1.0-1
Encode1 product
Kludex1 product
PyPI1 product
  • starlette< 1.0.1
Ubuntu1 product
  • starletteAll versions (No fix recorded)
Wolfi1 product
  • mlflow< 3.16.0-r0

9 vendors · 25 products

References

41 links
Show all 41 references