Most recent entries from all

CVE-2026-54282 — Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

2026-09-30T10:08:22.971926+00:00

Affected: Kludex starlette

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.

GHSA-jp82-jpqv-5vv3 — Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

2026-09-30T10:08:22.972124+00:00

Affected: PyPI: Starlette

### Summary

In affected versions, the HTTP request path is not validated before being used to reconstruct `request.url`. Because `request.url` is rebuilt by concatenating `{scheme}://{host}{path}` and re-parsing the result, a path that does not begin with `/` (for example `@google.com`) moves the authority boundary during re-parsing, so `request.url.hostname` and `request.url.netloc` become attacker-controlled. Code that reads `request.url.hostname` (rather than the `Host` header or `scope`) can therefore be misled into trusting an attacker-supplied host.

### Details

When a client requests a path that does not start with `/`:

```http GET @google.com HTTP/1.1 Host: localhost ```

affected versions reconstruct the URL as `http://localhost@google.com`. Per [RFC 3986 §3.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1), the substring before `@` in the authority is `userinfo`, so re-parsing yields `username = "localhost"` and `hostname = "google.com"`, with an empty path:

```text request.url == "http://localhost@google.com" request.url.hostname == "google.com" request.url.path == "" ```

The root cause is that the path is concatenated directly after the host without a separating `/`, and without validating that it begins with one. Only the `Host` header was validated when constructing `request.url`; the path was not.

This requires an ASGI server that forwards a request-target lacking a leading `/` into `scope["path"]`.

### Impact

Any application…

PYSEC-2026-248

2026-09-30T10:08:22.972231+00:00

Affected: PyPI: starlette