{"cve_id":"CVE-2026-48710","published":"2026-05-26T22:16:44.020000+00:00","last_modified":"2026-10-01T18:17:18.153000+00:00","vuln_status":"Analyzed","description":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","base_score":6.5,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"LOW","impact_i":"LOW","impact_a":"NONE","cwe_ids":["CWE-444","CWE-1289"],"in_kev":true,"kev_date_added":"2026-09-02","kev_ransomware":false,"epss_score":0.70288,"epss_percentile":0.99383,"cap_rule_version":"0.1.1","stage":"RECON","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"NONE","caps":["INFO_DISCLOSURE","TAMPER"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-10-02T03:16:12.714654+00:00","first_seen":"2026-05-26T22:16:44.020000+00:00","kev_first_seen":"2026-09-02T00:00:00+00:00","novelty_score":36.61,"novelty_reasons":["EPSS_SPIKE"],"novelty_at":"2026-11-02T03:21:44.260683+00:00","vendors":["encode","redhat"],"products":["ai_inference_server","ansible_automation_platform","enterprise_linux_ai","migration_toolkit_for_applications","openshift_ai","openshift_lightspeed","satellite","starlette"],"affected":[{"vendor":"encode","product":"starlette","ranges":["≥ 0.8.3 and < 1.0.1"]},{"vendor":"redhat","product":"ai_inference_server","ranges":["≥ 3.3.0 and ≤ 3.3.5"]},{"vendor":"redhat","product":"ansible_automation_platform","ranges":["2.6","2.7"]},{"vendor":"redhat","product":"enterprise_linux_ai","ranges":["3.0"]},{"vendor":"redhat","product":"migration_toolkit_for_applications","ranges":["< 8.2.0"]},{"vendor":"redhat","product":"openshift_ai","ranges":["≥ 3.4 and < 3.4.2","≥ 3.3 and < 3.3.5"]},{"vendor":"redhat","product":"openshift_lightspeed","ranges":["all versions"]},{"vendor":"redhat","product":"satellite","ranges":["6.17","6.18","6.19"]}]}