Vulnerability details
CVE-2026-48710
Actively exploited
Kludex starletteRed Hat Exploit IntelligenceRed Hat OpenShift LightspeedRed Hat AI Inference ServerRed Hat Enterprise Linux AI 3Red Hat OpenShift AI
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
CVSS 3.1
6.5Medium
Official description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 6.5Medium | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 6.5Medium | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Kludex | starlette | < 1.0.1 | CVEProject cvelistV5 (CNA) |
| Red Hat | Exploit Intelligence | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
References and advisories
29- https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr x_refsource_CONFIRM
- https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6 x_refsource_MISC
- https://badhost.org x_refsource_MISC
- https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml x_refsource_MISC
- https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette x_refsource_MISC
- https://www.secwest.net/starlette x_refsource_MISC
- https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette x_refsource_MISC
- https:/www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points third-party-advisory
- https://www.wiz.io/blog/ai-infrastructure-honeypot third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710 government-resource
- https://access.redhat.com/security/cve/CVE-2026-48710 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2481742 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:30089 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30088 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24866 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23346 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43038 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34456 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44696 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22993 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26226 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51357 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22992 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34532 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34526 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63337 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-27
- Last updated
- 2026-10-01
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 81 · Critical
CISA KEV catalog
- Date added
- 2026-09-02
- Due date
- 2026-09-16
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
70.28%
Probability of exploitation in 30 days
99.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CWE-1289Improper Validation of Unsafe Equivalence in Input