Encode has a security flaw

Published September 2, 2026 CVE-2026-48710

Starlette, a web toolkit used to build Python web apps and APIs, let attackers dodge login and access checks. A malformed Host header could trick the app into checking the wrong web address path, letting requests slip past security rules meant to block them.

Severity
MediumCVSS 3.1 · 6.5
Fix
Fixed in 1.0.1Fix recorded on Aug 26, 2026
Affected versions
before 1.0.1
Weakness
CWE-444HTTP Request Smuggling
Exploit likelihood
36% in 30 daysEPSS, higher than 98% of known flaws
Affects
Starlette
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Sep 2, 2026
Federal fix deadline
Sep 16, 2026

How it works

An attacker sends a request with a deliberately broken Host header, and Starlette used that header, instead of the real requested path, to rebuild the web address it checked security rules against, so the path it protected did not match the path it actually served.

What to do

Check your installed Starlette version with python3 -m pip show starlette and see if your app's middleware or endpoints restrict access based on request.url.path rather than the raw request path. If you rely on FastAPI, check which Starlette version it pulled in, since FastAPI depends on it directly.

Run this in the application environment you want to check:

python3 -m pip show starlette

Upgrade to Starlette 1.0.1 or later with python3 -m pip install -U starlette, which validates the Host header and falls back to safe server info when it looks malformed. Review any middleware that trusts request.url for security decisions.

Technical details

Starlette's routing used the raw ASGI scope path, but request.url was reconstructed from the client-supplied Host header without validation against RFC 9112 section 3.2 or RFC 3986 section 3.2.2 grammar. A malformed Host header could desynchronize request.url.path from the path actually routed, so middleware or endpoints that gate access on request.url.path (CWE-444, request smuggling-style inconsistency, and CWE-1289, improper input validation) could be bypassed. Fixed in 1.0.1 by validating the Host header and falling back to scope["server"] when it fails validation. Dubbed BadHost by X41 D-Sec, discovered during an OSTIF-sponsored audit.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact Low Some data can be read
  • Integrity impact Low Some data can be modified
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Open in FIRST.org calculator

References

View Original Source