- Medium 6.5
- Known exploited (CISA KEV)
CVE-2026-48710
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0…
Scores
The facts
- Published
- 26 May 2026
- Last changed
- 1 October 2026
- NVD status
- Analyzed
- Severity
- Medium, CVSS 6.5 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- Affects
- encode starlette
- redhat ai inference server
- redhat ansible automation platform
- redhat migration toolkit for applications
- redhat openshift ai
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 2 September 2026.
- EPSS
- 7.1% chance of exploitation activity in the next 30 days (percentile 94).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.