Kludex · Starlette
Starlette, the lightweight ASGI framework and toolkit from Kludex, fails to validate the HTTP Host request header before using it to rebuild request.url, so a malformed Host header can make request.url.path diverge from the path actually routed. An unauthenticated remote attacker sending a crafted request can bypass security restrictions that middleware or endpoints enforce based on request.url rather than the raw scope path, with no user interaction or special configuration required.
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) was available 55 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in starlette over 20 months. The latest fix listed for starlette is 1.3.1.
Remote HTTP request header manipulation exploits public-facing app
the HTTP `Host` request header was not validated before being used to reconstruct `request.url`
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: starlette.
Upgrade to 1.0.1 or later
pip install "starlette>=1.0.1"The first fix for CVE-2026-48710. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 1.0.1 | 1.0.1 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.