Skip to content
fr Sign in
3.7 Low

CVE-2026-54282 Starlette is a lightweight ASGI framework/toolkit

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.

Affected products and versions

Product Affected versions Fixed in
starlette 1.3 earliest → < 1.3.0 1.3.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of starlette

The 6 CVEs of starlette →
CVE-2026-54283 Starlette is a lightweight ASGI framework/toolkit 7.5 High CVE-2026-48817 Starlette is a lightweight ASGI framework/toolkit 5.3 Medium CVE-2026-48818 Starlette is a lightweight ASGI framework/toolkit 7.5 High CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability 6.5 Medium
Track this CVE