Skip to content
OpenAdvisories

Vendor

litestar-org

9 known vulnerabilities.

Products

litestar 9
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-48061

    Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The Allow…

    litestar-org litestar litestar PyPI
  • Medium 6.5
    CVE-2026-25480

    FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as respo…

    litestar-org litestar litestar PyPI
  • Medium 6.5
    CVE-2026-25479

    Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns

    Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . match…

    litestar-org litestar litestar PyPI