Answer in brief
CVE-2026-48710 records a Medium severity (CVSS 6.5) vulnerability in Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks. The current sources mark it as known exploited. The current feed maps Kludex/starlette (generic), starlette (pip), starlette (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Kludex/starlette (generic), starlette (pip), starlette (pypi). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:ansible_automation_platform:2.6:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:ansible_automation_platform:2.7:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:migration_toolkit_for_applications:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:satellite:6.17:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:satellite:6.19:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_ai:3.0:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Kludex/starlettegeneric | < 1.0.1 | Not reported |
| starlettepip | <=1.0.0 | 1.0.1 |
| starlettepypi | >=0 <1.0.1 | 1.0.1 |
Published upstream
May 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 23, 2026
Added to CISA KEV
Sep 2, 2026
Evidence: source:kev:kev:kev:recordStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Quoted source text, attributed separately from HOL analysis.