boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-48710MEDIUM
Kludex starlette — Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  N    6.5   .0184   77.3     —
AFFECTED
  Product    Versions   Fixed
  starlette  < 1.0.1 –  —
TIMELINE
  May 22  Reserved by GitHub_M
  May 26  EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
  May 26  Published (CNA: GitHub_M)
  Aug 10  EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
CWE-444 · CNA: GitHub_M · CVSS v3.1 · 24 references · NVD status: Modified

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Lifecycle

Complete event history — 4 events, chronological
DateEventDetail
May 22, 2026ReservedReserved by GitHub_M
May 26, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
May 26, 2026PublishedPublished (CNA: GitHub_M)
August 10, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
Kludexstarlette—< 1.0.1—

Weaknesses

CWE-444

References (24)

Related

Authoritative record: CVE-2026-48710 at cve.org

Vendors: kludex

Weaknesses: CWE-444

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-48710 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.