CVE-2026-48710

Modified Modified - Updated After Analysis

Host Header Validation Bypass in Starlette

Publication date: 2026-05-26

Last updated on: 2026-07-02

Assigner: GitHub, Inc.

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-26

Last Modified

2026-07-02

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-04

NVD

CVE-2026-48710

EUVD

EUVD-2026-32016

Affected Vendors & Products

Vendor	Product	Version / Range
encode	starlette	From 0.8.3 (inc) to 1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
CWE-1289	The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Starlette versions prior to 1.0.1 where the HTTP Host request header was not validated before being used to reconstruct the request URL.

Because the routing algorithm uses the raw HTTP path but the request URL is rebuilt from the Host header, a malformed Host header could cause the reconstructed request URL path to differ from the actual requested path.

This discrepancy allows middleware and endpoints that rely on the reconstructed request URL for security checks to be bypassed, potentially allowing unauthorized access or actions.

The issue is fixed in Starlette version 1.0.1 and later, where the Host header is validated according to RFC 9112 §3.2 and RFC 3986 §3.2.2, and falls back to a safe server value if the Host header is malformed.

Compliance Impact

This vulnerability allows bypassing security restrictions based on the reconstructed request URL due to improper validation of the HTTP Host header. Such bypasses could potentially lead to unauthorized access or information disclosure.

While the CVE description does not explicitly mention compliance with standards like GDPR or HIPAA, any security bypass that could lead to unauthorized access or data leakage may impact compliance with these regulations, which require protection of personal and sensitive data.

Therefore, organizations using affected versions of Starlette should upgrade to version 1.0.1 or later to ensure proper validation and reduce the risk of non-compliance due to security control bypass.

Impact Analysis

This vulnerability can impact you by allowing attackers to bypass security restrictions that rely on the reconstructed request URL.

Since the routing uses the raw path but security checks use the potentially manipulated request URL, an attacker can craft a malformed Host header to evade access controls or other security mechanisms.

This could lead to unauthorized access to protected resources or execution of actions that should have been blocked.

Mitigation Strategies

To mitigate this vulnerability, users should upgrade Starlette to version 1.0.1 or later.

Version 1.0.1 and above validate the HTTP Host header against the grammar of RFC 9112 §3.2 and RFC 3986 §3.2.2 when constructing request.url, and fall back to scope["server"] for malformed values, preventing the bypass.

Hi! I’m here to help you understand CVE-2026-48710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70