CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Reference page built from the source records below, each shown as its source publishes it. Dataset version ref-ee08de2ec855, updated 2026-11-02T23:39:54.475Z.

CISA Known Exploited Vulnerabilities

Name
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Vendor
Kludex
Product
Starlette
Added to the catalog
2026-09-02
Due date for US federal agencies
2026-09-16
Weaknesses
CWE-444
Catalog version
2026.10.30

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status
Analyzed
Published
2026-05-26T22:16:44.020
Last modified
2026-10-01T18:17:18.153
Weaknesses
CWE-444, CWE-1289

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

MetricScoreSeverityVectorScored by
CVSS 3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N[email protected] (Secondary)
CVSS 3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N[email protected] (Primary)
CVSS 3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

References

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:42:31.494Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-48710

CVE record

Title (CNA)
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Assigner
GitHub_M
State
PUBLISHED
Published
2026-05-26T21:54:54.393Z
Updated
2026-10-01T17:41:26.242Z
Problem types
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

References

Read on 2026-11-03T02:20:21.283Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json

GitHub Advisory Database

GHSA-86qp-5c8j-p5mr: Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Severity (GitHub)
medium
CVSS
6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-444, CWE-1289
Published
2026-06-04T13:15:17Z
Updated
2026-08-28T18:31:00Z
  • pip starlette: affected <= 1.0.0, first patched 1.0.1

### Summary
In affected versions, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed.

### Details
When a client requests `http://example.com/foo`, it sends:

```http
GET /foo HTTP/1.1
Host: example.com
```

Affected versions reconstructed the URL by concatenating `http://{host}{path}` and re-parsing the result. The `Host` value is only valid as a `uri-host [ ":" port ]` per [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6), where `uri-host` follows the restricted `host` grammar of [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2). When it contains characters outside that grammar - notably `/`, `?`, or `#` - those characters move the path/query/fragment boundaries during re-parsing, so the parsed `request.url.path` no longer matches the path the server actually received. For example:

```http
GET /foo HTTP/1.1
Host: example.com/abc?bar=
```

reconstructs to `http://example.com/abc?bar=/foo`, whose parsed `path` is `/abc` - even though routing used the real path `/foo`. The router still dispatches to `/foo` and the endpoint executes, but any middleware or code that reads `request.url.path` sees `/abc`, so path-based authorization checks can be bypassed.

### Impact
Any application running an affected version that relies on `request.url` (or `request.url.path`) for security-sensitive decisions is affected. The most common case is middleware that gates access to certain path prefixes based on `request.url.path`. Deployments fronted by a proxy or load balancer are mitigated only if that proxy rejects or normalizes the malformed `Host` header before forwarding and the application does not trust attacker-controlled host headers (e.g. `X-Forwarded-Host`) elsewhere.

### Mitigation
Upgrade to a patched version, which validates the `Host` header against the grammar of [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6) / [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2) when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Read on 2026-11-03T00:47:45.930Z under licence ghsa-cc-by-4.0@9e5f1b3c from https://api.github.com/advisories/GHSA-86qp-5c8j-p5mr

Also known as / affected packages

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

D3FEND lists no defensive technique for this weakness.

D3FEND ontology version 1.6.0.

Read on 2026-11-02T23:56:41.738Z under licence d3fend-terms-of-use@f98cbc7e from https://d3fend.mitre.org/api/weakness/cwe/CWE-444.json

CWE-1289: Improper Validation of Unsafe Equivalence in Input

D3FEND ontology version 1.6.0.

Read on 2026-11-03T00:03:36.834Z under licence d3fend-terms-of-use@f98cbc7e from https://d3fend.mitre.org/api/weakness/cwe/CWE-1289.json

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/

Sources and licences

  • CISA

    Source: CISA Catalog of Known Exploited Vulnerabilities, version 2026.10.30, CC0 1.0. Use of this data does not imply endorsement by CISA or DHS.

    CC0 1.0 Universal

  • National Vulnerability Database (NIST)

    This product uses the NVD API but is not endorsed or certified by the NVD.

    NVD API Terms of Use (NIST publications in the public domain, 17 U.S.C. 105)

  • CVE Program, The MITRE Corporation

    Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

    CVE Program Terms of Use ("CVE Usage" licence)

  • GitHub Advisory Database

    Source: GitHub Advisory Database, https://github.com/advisories/GHSA-86qp-5c8j-p5mr, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Changes: fields selected and reformatted by ransomware-tracker.com.

    CC BY 4.0

  • GitHub Advisory Database via OSV.dev

    GHSA-86qp-5c8j-p5mr: GitHub Advisory Database, https://github.com/advisories/GHSA-86qp-5c8j-p5mr. Licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), provided as is, without warranties. Retrieved via OSV.dev (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr), which enriches records; fields selected and reformatted by ransomware-tracker.com.

    CC BY 4.0

  • MITRE D3FEND

    MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
    "The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/

    MITRE D3FEND Terms of Use (site + knowledge graph); source repo MIT

Cite this page

Dragons Eye Ransomware Tracker, "CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability",
entity page, dataset version ref-ee08de2ec855, updated 2026-11-02T23:39:54.475Z,
https://ransomware-tracker.com/cve/CVE-2026-48710 (accessed 2026-11-03).
Underlying source: CISA Catalog of Known Exploited Vulnerabilities, version 2026.10.30.
Underlying source: National Vulnerability Database (NIST), CVE API 2.0, record last modified 2026-10-01T18:17:18.153.
Underlying source: CVE List (CVE Program, The MITRE Corporation), record updated 2026-10-01T17:41:26.242Z.
Underlying source: GitHub Advisory Database, GHSA-86qp-5c8j-p5mr, updated 2026-08-28T18:31:00Z.
Underlying source: GitHub Advisory Database, GHSA-86qp-5c8j-p5mr, via OSV.dev, modified 2026-09-10T03:51:08.121685407Z.
Underlying source: MITRE D3FEND, ontology version 1.6.0.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.

CISA KEV index