Vulnerability-Lookup

FKIE_CVE-2026-48710

Vulnerability from fkie_nvd - Published: 2026-05-26 22:16 - Updated: 2026-06-17 10:55

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

References

URL	Tags
security-advisories@github.com	https://badhost.org	Mitigation, Third Party Advisory
security-advisories@github.com	https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6	Patch
security-advisories@github.com	https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr	Vendor Advisory
security-advisories@github.com	https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml	Third Party Advisory
security-advisories@github.com	https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette	Mitigation, Third Party Advisory
security-advisories@github.com	https://www.secwest.net/starlette	Exploit, Mitigation, Third Party Advisory
security-advisories@github.com	https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette	Exploit, Mitigation, Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-48710
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://badhost.org	Mitigation, Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6	Patch
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr	Vendor Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml	Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette	Mitigation, Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://www.cve.org/CVERecord?id=CVE-2026-48710
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://www.secwest.net/starlette	Exploit, Mitigation, Third Party Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette	Exploit, Mitigation, Third Party Advisory

Impacted products

	Vendor	Product	Version
	encode	starlette	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "starlette",
          "vendor": "Kludex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-tpu-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cpu-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-spyre-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8",
          "product": "ansible_automation_platform-2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaii/vllm-gaudi-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaii/vllm-rocm-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-tpu-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaii/vllm-cuda-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-26/lightspeed-chatbot-rhel9",
          "product": "ansible_automation_platform-2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-spyre-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaii/vllm-spyre-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected",
          "packageName": "ansible-automation-platform-26/mcp-tools-rhel9",
          "product": "ansible_automation_platform-2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaii/vllm-cpu-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "mta/mta-solution-server-rhel9",
          "product": "mta-8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9",
          "product": "exploit-intelligence",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "openshift-lightspeed/lightspeed-ocp-rag-rhel9",
          "product": "ols-1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaii/vllm-tpu-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-neuron-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhaii/vllm-neuron-rhel9",
          "product": "ai-inference-server-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "openshift-lightspeed/lightspeed-service-api-rhel9",
          "product": "ols-1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-caikit-nlp-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-aws-cuda-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "ask-sre",
          "product": "openshift-hosted-osd4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-azure-cuda-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-built-in-detector-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-gaudi-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-rocm-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/disk-image-cuda-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-gcp-cuda-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-cuda-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/iop-advisor-engine-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhel-cla/rlsapi-rhel10",
          "product": "rhel-cla-0",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-azure-rocm-rhel9",
          "product": "rhel-ai-3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-vllm-cuda-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-llama-stack-core-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-feature-server-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-vllm-gaudi-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-caikit-tgis-serving-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-controller-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-feature-server-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-agent-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-router-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-vllm-gaudi-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-automl-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-mlflow-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-llama-stack-core-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-built-in-detector-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-built-in-detector-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-vllm-rocm-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-feature-server-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-mlserver-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-router-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-agent-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-controller-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-kserve-autogluon-server-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-vllm-gaudi-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-llm-d-kv-cache-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-mlflow-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-mlserver-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-llama-stack-core-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "aap-installers-rag-content",
          "product": "services-ansible-lightspeed-chatbot",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/iop-vulnerability-engine-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/iop-vmaas-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/foreman-mcp-server-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/iop-host-inventory-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/iop-host-inventory-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
          "product": "openshift-ai",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/foreman-mcp-server-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "aap-rag-content",
          "product": "services-ansible-lightspeed-chatbot",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "ansible-chatbot-stack",
          "product": "services-ansible-lightspeed-chatbot",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/iop-vulnerability-engine-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "satellite/iop-vmaas-rhel9",
          "product": "rhn_satellite_6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "nexus",
          "product": "services-ansible-nexus",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "cloudservices/insights-inventory",
          "product": "services-inventory",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "insights-host-inventory",
          "product": "services-inventory",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected",
          "packageName": "ansible-mcp-tools",
          "product": "services-ansible-lightspeed-chatbot",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "cloudservices/rbac",
          "product": "services-management-platform",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "digital-roadmap-backend",
          "product": "services-digital-roadmap",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "automation-analytics-backend",
          "product": "services-ansible-on-clouds",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "insights-rbac",
          "product": "services-management-platform",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "unknown@sha256:456a1542e13586a1c2cf1bbbb146124ca53041f5b9680becbebe10095afe881f/unknown@sha256:456a1542e13586a1c2cf1bbbb146124ca53041f5b9680becbebe10095afe881f",
          "product": "services-ansible-lightspeed-chatbot",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected",
          "packageName": "okp-mcp",
          "product": "services-rhel-lightspeed",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected",
          "packageName": "google-lightspeed-agent",
          "product": "services-lightspeed-agent-google-cloud",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "cloudservices/vulnerability-engine-app",
          "product": "services-vulnerability-engine",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "vmaas",
          "product": "services-vulnerability-engine",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected",
          "packageName": "vulnerability-engine",
          "product": "services-vulnerability-engine",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "4C7C6045-86A6-4FAC-AE15-B12438E9D1B4",
              "versionEndExcluding": "1.0.1",
              "versionStartIncluding": "0.8.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 \u00a73.2 / RFC 3986 \u00a73.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values."
    }
  ],
  "id": "CVE-2026-48710",
  "lastModified": "2026-06-17T10:55:13.440",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48710",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-27T14:22:19.241769Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-26T22:16:44.020",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://badhost.org"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.secwest.net/starlette"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://badhost.org"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.secwest.net/starlette"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1289"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

CVE-2026-48710 (GCVE-0-2026-48710)

Vulnerability from cvelistv5 – Published: 2026-05-26 21:54 – Updated: 2026-06-30 01:48

Title

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Assigner

GitHub_M

References

17 references

URL	Tags
https://github.com/Kludex/starlette/security/advi…	x_refsource_CONFIRM
https://github.com/Kludex/starlette/commit/764dab…	x_refsource_MISC
https://badhost.org	x_refsource_MISC
https://github.com/pypa/advisory-database/tree/ma…	x_refsource_MISC
https://ostif.org/disclosing-the-badhost-vulnerab…	x_refsource_MISC
https://www.secwest.net/starlette	x_refsource_MISC
https://www.x41-dsec.de/lab/advisories/x41-2026-0…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-48710	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2481742	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:30089	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30088	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24866	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23346	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22993	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26226	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22992	vendor-advisoryx_refsource_REDHAT

Impacted products

14 products

Vendor	Product	Version
Kludex	starlette	Affected: < 1.0.1
Red Hat	Red Hat AI Inference Server 3.3	cpe:/a:redhat:ai_inference_server:3.3::el9
Red Hat	Red Hat Ansible Automation Platform 2.6	cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Ansible Automation Platform 2.7	cpe:/a:redhat:ansible_automation_platform:2.7::el9
Red Hat	Red Hat Satellite 6.18	cpe:/a:redhat:satellite:6.18::el9
Red Hat	Red Hat Satellite 6.19	cpe:/a:redhat:satellite:6.19::el9
Red Hat	Exploit Intelligence	cpe:/a:redhat:exploit_intelligence:0
Red Hat	Migration Toolkit for Applications 8	cpe:/a:redhat:migration_toolkit_applications:8
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	Red Hat AI Inference Server	cpe:/a:redhat:ai_inference_server:3
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T14:22:19.241769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T14:26:57.893Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3.3::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat AI Inference Server 3.3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ansible Automation Platform 2.6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ansible Automation Platform 2.7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:satellite:6.18::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Satellite 6.18",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:satellite:6.19::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Satellite 6.19",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:exploit_intelligence:0"
            ],
            "defaultStatus": "affected",
            "product": "Exploit Intelligence",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8"
            ],
            "defaultStatus": "affected",
            "product": "Migration Toolkit for Applications 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ai_inference_server:3"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat AI Inference Server",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-26T21:54:54.393Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Critical"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1289",
                "description": "Improper Validation of Unsafe Equivalence in Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T01:48:17.511Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
          },
          {
            "name": "RHBZ#2481742",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30089"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30088"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24866"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23346"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22993"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26226"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22992"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:30089: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30088: Red Hat AI Inference Server 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24866: Red Hat Ansible Automation Platform 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23346: Red Hat Ansible Automation Platform 2.7"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22993: Red Hat Satellite 6.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26226: Red Hat Satellite 6.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22992: Red Hat Satellite 6.19"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-26T23:01:03.204Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-26T21:54:54.393Z",
            "value": "Made public."
          }
        ],
        "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
        "workarounds": [
          {
            "lang": "en",
            "value": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "starlette",
          "vendor": "Kludex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 \u00a73.2 / RFC 3986 \u00a73.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T21:54:54.393Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
        },
        {
          "name": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
        },
        {
          "name": "https://badhost.org",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://badhost.org"
        },
        {
          "name": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
        },
        {
          "name": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
        },
        {
          "name": "https://www.secwest.net/starlette",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.secwest.net/starlette"
        },
        {
          "name": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
        }
      ],
      "source": {
        "advisory": "GHSA-86qp-5c8j-p5mr",
        "discovery": "UNKNOWN"
      },
      "title": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48710",
    "datePublished": "2026-05-26T21:54:54.393Z",
    "dateReserved": "2026-05-22T18:47:27.755Z",
    "dateUpdated": "2026-06-30T01:48:17.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2026-48710

CVE-2026-48710 (GCVE-0-2026-48710)

Tags

Sightings

Nomenclature