Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48710— Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Quick assessment

Affected
Kludex starlette
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Starlette是Encode开源的一个轻量级的 ASGI 框架/工具包。非常适合用 Python 构建异步 web 服务。 Starlette 1.0.1之前版本存在环境问题漏洞，该漏洞源于未验证HTTP Host请求头，导致基于request.url的安全限制可能被绕过。

CVSS 6.5 · Medium KEV EPSS 7.06% · P94

Public Exploits 1

Nuclei · 1 CVE-2026-48710.yaml [template]

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Kludex starlette < 1.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48710

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Source: CVE Program / CVE List V5
Vulnerability Description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5
Vulnerability Title
Starlette 环境问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Starlette是Encode开源的一个轻量级的 ASGI 框架/工具包。非常适合用 Python 构建异步 web 服务。 Starlette 1.0.1之前版本存在环境问题漏洞，该漏洞源于未验证HTTP Host请求头，导致基于request.url的安全限制可能被绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Kludex starlette < 1.0.1 -

II. Public POCs for CVE-2026-48710

# POC Description Source Link Shenlong Link
1 A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on request.url for validation could be bypassed, potentially allowing unauthorized access or actions. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48710.yaml POC Details
AI-Generated POC Verified env Premium
Reproduced successfully in a real sandbox · Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker: VULNERABLE: HTTP/1.1 200 OK ; body exfiltrated protected secret PROOF_beb0ada5b3193a74 via Host-header path poisoning (baseline was HTTP/1.1 403 Forbidden)
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code · 16541 chars
GitHub 复现环境（可 clone 直接跑）
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-48710

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-48710 (1)

Vendor Advisories for CVE-2026-48710 (4)

Security Blog Posts for CVE-2026-48710 (1)

News Coverage for CVE-2026-48710 (1)

IV. Related Vulnerabilities

Same product: starlette
Same vendor: Kludex
Same weakness: CWE-444

V. Comments for CVE-2026-48710

No comments yet

Leave a comment