PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48710 Kludex CVE debrief

A vulnerability in Starlette (prior to version 1.0.1) allows security bypasses by exploiting malformed HTTP Host headers. The framework failed to validate the Host header before using it to reconstruct `request.url`, creating a mismatch between the routing path and the URL path exposed to middleware and endpoints. Security controls relying on `request.url` rather than the raw ASGI scope path could be circumvented. The fix validates Host headers against RFC 9112 §3.2 / RFC 3986 §3.2.2 grammar and falls back to `scope['server']` for malformed values.

Vendor
Kludex
Product
starlette
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-08-10
Advisory published
2026-05-26
Advisory updated
2026-08-10

Who should care

Organizations running Starlette-based applications with security middleware or endpoint authorization logic; developers implementing path-based access controls in ASGI applications; security teams reviewing Python web framework deployments

Technical summary

The vulnerability stems from Starlette's URL reconstruction logic, which used the unvalidated HTTP Host header to build `request.url` while the routing algorithm relied on the raw HTTP path. This architectural inconsistency meant that a malformed Host header could cause `request.url.path` to diverge from the actual requested path. Security middleware and endpoints performing authorization, rate limiting, or other access controls based on `request.url` would evaluate a different path than the one routed to, enabling bypass attacks. The fix implements strict Host header validation per RFC 9112 §3.2 and RFC 3986 §3.2.2, with fallback to `scope['server']` when validation fails, ensuring URL reconstruction integrity.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Starlette to version 1.0.1 or later
  • Audit middleware and endpoints that apply security restrictions based on request.url
  • Replace request.url-based security checks with raw scope['path'] or scope['raw_path'] where path integrity is critical
  • Review reverse proxy and load balancer configurations to ensure Host header sanitization
  • Monitor application logs for malformed Host header requests as potential exploitation indicators

Evidence notes

Official CVE record published 2026-05-26. GitHub Security Advisory GHSA-86qp-5c8j-p5mr confirms affected versions and fix commit. Multiple independent security research organizations (OSTIF, X41 D-Sec, SecWest) published coordinated disclosure materials. Fix commit 764dab0dcfb9033d75442d7a359645c9f94648c6 validates Host header grammar per RFC specifications.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48710 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48710

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48710 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48710

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.