CVE-2026-48061

Received Received - Intake

Host Header Injection in Litestar Framework

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that strips X-Forwarded-Host, or when accepting HTTP/1.0 connections. This issue has been fixed in version 2.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-48061

Affected Vendors & Products

Vendor	Product	Version / Range
litestar	litestar	to 2.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-644	The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Attack-Flow Graph

Executive Summary

Litestar is an ASGI framework vulnerable in versions before 2.22.0. An attacker can bypass host validation by omitting the Host header and using an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts this header when the Host header is missing, enabling host header injection attacks like password reset poisoning or cache poisoning.

Detection Guidance

To detect this vulnerability, check if your Litestar application is running a version prior to 2.22.0. Inspect HTTP requests for missing Host headers with X-Forwarded-Host headers set to whitelisted domains. Use tools like curl to send test requests without a Host header but with X-Forwarded-Host to see if the server processes them.

Impact Analysis

This vulnerability allows attackers to manipulate server-side behavior by injecting malicious host headers. Potential impacts include password reset poisoning, cache poisoning, and server-side request routing manipulation. Systems deployed without reverse proxies stripping X-Forwarded-Host or accepting HTTP/1.0 connections are at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling host header injection attacks. Such attacks may lead to unauthorized access to sensitive data, which violates GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade Litestar to version 2.22.0 or later. Ensure your reverse proxy strips X-Forwarded-Host headers before forwarding requests. Configure AllowedHostsMiddleware to reject requests without a Host header. Disable HTTP/1.0 support if not required.

Hi! I’m here to help you understand CVE-2026-48061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70