Starlette Host-header URL confusion / path smuggling (CVE-2026-48710); CISA KEV

Kludex Starlette GHSA-86qp-5c8j-p5mr (CVE-2026-48710) is an HTTP request/response path confusion: affected builds rebuild request.url from an unvalidated Host header, so a malformed Host can make request.url.path differ from the path the router actually dispatched. Middleware that authorises on request.url.path can be bypassed. GHSA rates Moderate; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5). Affected through 1.0.0; patched in 1.0.1. CISA added it to the KEV catalog on 2 September 2026 based on evidence of active exploitation. Upgrade Starlette (and FastAPI stacks that pin it) to 1.0.1 or later; ensure front-end proxies reject malformed Host headers.

Product

Kludex Starlette

Versions

Affected through 1.0.0; fixed in 1.0.1

CVSS

6.5 (CVSS 3.1 Moderate, GHSA vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Exploited in Australia?

unknown

Patch to

Starlette 1.0.1 or later; reject malformed Host at the proxy

Primary: GitHub GHSA-86qp-5c8j-p5mr (Starlette) · Vendor: Kludex Starlette (vendor advisory) · CVE: CVE-2026-48710 · CISA KEV alert (2 Sep 2026)

vulnerabilities cloud