{"schemaVersion":3,"id":"CVE-2026-54282","aliases":["GHSA-jp82-jpqv-5vv3","PYSEC-2026-248","UBUNTU-CVE-2026-54282","DEBIAN-CVE-2026-54282","CGA-3f45-vgf3-2cg4","CGA-3pj3-p3q3-8q53","CGA-5mm4-m463-55h4","CGA-6mg5-f2qq-fqc8","CGA-8xcv-frw8-94px","CGA-m727-5c9f-4pj6","CGA-p5p2-3vpc-2hg3","CGA-v3f8-p674-94jh","CGA-vjgx-8m53-x9pm","CGA-vvf6-8p22-jv4j","CGA-wf52-v8p7-hmcc","CGA-wpj6-53m3-r38j","CGA-x8w3-6xj3-vjhj","openSUSE-SU-2026:11058-1","CGA-25wg-9jwr-6hqw","CGA-2x6j-gq6f-jx53","CGA-3w5m-wwc5-g69j","CGA-4226-wrqc-7xc8","CGA-629h-qmqx-x482","CGA-62x6-qrxp-3qhj","CGA-6f4v-hrfg-rgf4","CGA-7jxx-xq8x-frxx","CGA-82hx-jv9q-6xqj","CGA-8mqc-m79c-4384","CGA-8q89-9gw2-h5g2","CGA-978g-pf3m-mx6p","CGA-97w4-r55q-j5jp","CGA-9f4q-7w42-x586","CGA-9g6h-5p67-498w","CGA-c86m-84h5-gh6w","CGA-cx72-m8c5-gp3h","CGA-g43j-8cq5-j6r4","CGA-g4h9-gpr8-73gq","CGA-h7pp-9jpg-pqp6","CGA-h8w7-rrh7-gfrc","CGA-m79c-4pf4-c64m","CGA-mm38-4rc6-rx7r","CGA-mmcg-8rvf-6wm5","CGA-p9mm-39mq-23mg","CGA-pj8v-xc4h-jw2x","CGA-pvmx-3vpm-vvpq","CGA-q5c7-vhxf-xfcv","CGA-qm9h-3862-348w","CGA-rj28-gm83-wf3v","CGA-rwj8-cf7g-cj96","CGA-w3pj-3m4q-f897","CGA-wppm-9m92-wrgc","CGA-wvcf-ph87-h2q4","CGA-xjxr-946h-rmfg"],"status":"published","duplicateOf":null,"title":null,"description":"Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.","dates":{"published":"2026-06-22T16:45:01.629Z","modified":"2026-06-22T17:26:58.637Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00273,"percentile":0.18496,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.086,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00187},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00273,"percentile":0.18496}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00187,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00273,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00273,"percentile":0.18496}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-706","name":"Use of Incorrectly-Resolved Name or Reference","description":"The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/706.html"}],"affected":[{"vendor":"chainguard","product":"airflow-3","name":"airflow-3","label":"airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-3","purlType":"apk","versions":[{"text":"< 3.2.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-core-3","name":"airflow-core-3","label":"airflow-core-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-core-3","purlType":"apk","versions":[{"text":"< 3.2.2-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.2-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-postgres-fips-3","name":"airflow-postgres-fips-3","label":"airflow-postgres-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-postgres-fips-3","purlType":"apk","versions":[{"text":"< 3.2.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keep-api","name":"keep-api","label":"keep-api","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keep-api","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keep-api-fips","name":"keep-api-fips","label":"keep-api-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keep-api-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kserve","name":"kserve","label":"kserve","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve","purlType":"apk","versions":[{"text":"< 0.20.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.0-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kserve-localmodel","name":"kserve-localmodel","label":"kserve-localmodel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve-localmodel","purlType":"apk","versions":[{"text":"< 0.20.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.0-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kserve-storage-controller","name":"kserve-storage-controller","label":"kserve-storage-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve-storage-controller","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.20.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.20.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"litellm","name":"litellm","label":"litellm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/litellm","purlType":"apk","versions":[{"text":"< 1.89.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.89.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"mlflow","name":"mlflow","label":"mlflow","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/mlflow","purlType":"apk","versions":[{"text":"< 3.13.0-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.16.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.13.0-r1 | < 3.16.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"mlflow-fips","name":"mlflow-fips","label":"mlflow-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/mlflow-fips","purlType":"apk","versions":[{"text":"< 3.13.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.13.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"mlrun-api","name":"mlrun-api","label":"mlrun-api","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/mlrun-api","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"mlrun-api-fips","name":"mlrun-api-fips","label":"mlrun-api-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/mlrun-api-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"< 2.7.3-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.3-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opal","name":"opal","label":"opal","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opal","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.11-prefect","name":"py3.11-prefect","label":"py3.11-prefect","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.11-prefect","purlType":"apk","versions":[{"text":"< 3.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.11-prefect-fips","name":"py3.11-prefect-fips","label":"py3.11-prefect-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.11-prefect-fips","purlType":"apk","versions":[{"text":"< 3.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-prefect","name":"py3.12-prefect","label":"py3.12-prefect","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-prefect","purlType":"apk","versions":[{"text":"< 3.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-prefect-fips","name":"py3.12-prefect-fips","label":"py3.12-prefect-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-prefect-fips","purlType":"apk","versions":[{"text":"< 3.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-prefect","name":"py3.13-prefect","label":"py3.13-prefect","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-prefect","purlType":"apk","versions":[{"text":"< 3.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-prefect-fips","name":"py3.13-prefect-fips","label":"py3.13-prefect-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-prefect-fips","purlType":"apk","versions":[{"text":"< 3.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.14-prefect","name":"py3.14-prefect","label":"py3.14-prefect","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.14-prefect","purlType":"apk","versions":[{"text":"< 3.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"semgrep","name":"semgrep","label":"semgrep","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/semgrep","purlType":"apk","versions":[{"text":"< 1.167.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.167.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tritonserver-backend-vllm-cuda-12.9","name":"tritonserver-backend-vllm-cuda-12.9","label":"tritonserver-backend-vllm-cuda-12.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tritonserver-backend-vllm-cuda-12.9","purlType":"apk","versions":[{"text":"< 25.9.0_git20260617-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.9.0_git20260617-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tritonserver-backend-vllm-cuda-13.0","name":"tritonserver-backend-vllm-cuda-13.0","label":"tritonserver-backend-vllm-cuda-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tritonserver-backend-vllm-cuda-13.0","purlType":"apk","versions":[{"text":"< 25.11-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.11-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"airflow-3","name":"airflow-3","label":"airflow-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/airflow-3","purlType":"apk","versions":[{"text":"< 3.2.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.2-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kserve","name":"kserve","label":"kserve","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kserve","purlType":"apk","versions":[{"text":"< 0.20.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.0-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kserve-localmodel","name":"kserve-localmodel","label":"kserve-localmodel","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kserve-localmodel","purlType":"apk","versions":[{"text":"< 0.20.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.0-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kserve-storage-controller","name":"kserve-storage-controller","label":"kserve-storage-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kserve-storage-controller","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.20.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.20.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"mlflow","name":"mlflow","label":"mlflow","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/mlflow","purlType":"apk","versions":[{"text":"< 3.13.0-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.16.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.13.0-r1 | < 3.16.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"semgrep","name":"semgrep","label":"semgrep","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/semgrep","purlType":"apk","versions":[{"text":"< 1.167.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.167.0-r1","eol":null,"hubHref":null},{"vendor":"debian","product":"starlette","name":"starlette","label":"starlette","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/starlette","purlType":"deb","versions":[{"text":"< 0.26.1-1+deb12u2","noFixRecorded":false,"fixedIn":null},{"text":"< 0.46.1-3+deb13u3","noFixRecorded":false,"fixedIn":null},{"text":"< 1.3.1-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.26.1-1+deb12u2 | < 0.46.1-3+deb13u3 | < 1.3.1-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"starlette","name":"starlette","label":"starlette","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/starlette","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"encode","product":"starlette","name":"starlette","label":"starlette","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0","eol":null,"hubHref":"/vendor/encode/starlette"},{"vendor":"kludex","product":"starlette","name":"Starlette","label":"starlette","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0","eol":null,"hubHref":"/vendor/kludex/starlette"},{"vendor":"PyPI","product":"starlette","name":"starlette","label":"starlette","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/starlette","purlType":"pypi","versions":[{"text":"< 1.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0","eol":null,"hubHref":null},{"vendor":"opensuse","product":"python-starlette&distro=openSUSE Tumbleweed","name":"python-starlette","label":"python-starlette&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/python-starlette&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.3.1-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.1-1.1","eol":null,"hubHref":null}],"affectedCount":37,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3","label":"github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory","REPORT","Mitigation","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54282","label":"nvd.nist.gov/vuln/detail/CVE-2026-54282","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/Kludex/starlette","label":"github.com/Kludex/starlette","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-248.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-248.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2026-54282","label":"ubuntu.com/security/CVE-2026-54282","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54282","label":"www.cve.org/CVERecord?id=CVE-2026-54282","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://github.com/Kludex/starlette/pull/3326","label":"github.com/Kludex/starlette/pull/3326","hostname":"github.com","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54282","label":"security-tracker.debian.org/tracker/CVE-2026-54282","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54282.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54282.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54282","label":"www.suse.com/security/cve/CVE-2026-54282","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["MGASA-2026-0413","OPENSUSE-SU-2026:21053-1","SUSE-SU-2026:22360-1"],"duplicates":[],"related":["CGA-9JXV-P7X8-3RW8","OPENSUSE-SU-2026:21053-1","SUSE-SU-2026:22360-1"]},"timeline":[{"kind":"published","date":"2026-06-22T16:45:01.629Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-22T17:26:58.637Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:40:32.385Z","stale":false,"partial":false}}