Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns
Vulnerability Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability Type
不正确的正则表达式
Vulnerability Title
Litestar 安全漏洞
Vulnerability Description
Litestar是Litestar开源的一个强大、灵活但固执己见的 ASGI 框架。 Litestar 2.20.0之前版本存在安全漏洞，该漏洞源于允许列表条目编译方式不当，可能导致绕过主机名验证。
CVSS Information
N/A
Vulnerability Type
N/A