Description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kludex | starlette | < 1.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | starlette | 1.1.0-1 | — |
| Debian 13 | starlette | 0.46.1-3+deb13u2 | — |
| Debian 12 | starlette | 0.26.1-1+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | starlette | No fix yet | — |
| Ubuntu 26.04 LTS | starlette | No fix yet | — |
| Ubuntu 25.10 | starlette | No fix yet | — |
| Ubuntu 24.04 LTS | starlette | No fix yet | — |
| Ubuntu 22.04 LTS | starlette | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-starlette | 0.41.3-160000.3.1 | SUSE-SU-2026:22151-1 |
| SLES 16.0 | python-starlette | 0.41.3-160000.3.1 | SUSE-SU-2026:22151-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-google-adk | 2.2.0-1.1 | openSUSE-SU-2026:11044-1 |
| openSUSE Tumbleweed | python-starlette | 1.2.0-1.1 | openSUSE-SU-2026:11026-1 |
| openSUSE Leap 16.0 | python-starlette | 0.41.3-160000.3.1 | openSUSE-SU-2026:20975-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-starlette | 1.1.0-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
eris-ths/supply-chain-guard ★ 3 · Apr 1, 2026
Detect, assess, and respond to supply chain attacks across npm/yarn and Python (pip/poetry/uv). Claude Code skill + standalone scripts. Built during axios RAT (2026-03-31) and Starlette BadHost CVE-2…
-
Bhanunamikaze/BadHost-CVE-2026-48710-Exploit ★ 1 · May 28, 2026
Detection scanner for CVE-2026-48710 - Host-header auth bypass in Starlette/FastAPI
-
xtremebeing/starlette-host-header-lab ★ 1 · May 27, 2026
Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710
-
CuteeCat/CVE-2026-48710 ★ 0 · Aug 11, 2026
CVE-2026-48710漏洞验证代码
-
sb-ox/repro-OXDEV-77637-uv-workspace ★ 0 · Aug 3, 2026
OXDEV-77637 repro fixture: uv workspace whose transitive CVE (starlette 0.25.0 / CVE-2026-48710) is dropped when the lean clone omits workspace-member pyproject.toml. Tag: repro-OXDEV-77637
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Starlette - Improper Validation of Unsafe Equivalence in Input http/cves/2026/CVE-2026-48710.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | starlette | < 1.0.1 | 1.0.1 | GHSA-86qp-5c8j-p5mr |
Advisories 5
- openSUSE-SU-2026:20975-1 Security update for python-starlette SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22151-1 Security update for python-starlette SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:11044-1 python311-google-adk-2.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 17, 2026
- openSUSE-SU-2026:11026-1 python311-starlette-1.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 14, 2026
- NCSC-2026-0171 Kwetsbaarheid verholpen in Starlette NCSC-NL (Netherlands) · May 29, 2026
References
- https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
- https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
- https://badhost.org
- https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
- https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
- https://www.secwest.net/starlette
- https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette