PyPI/litestar CVE-2026-25480: medium 6.5, EPSS 0.47%

Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

Action: Upgrade litestar to 2.20.0 or later.

pip install litestar==2.20.0

Affected

Fixed versions

Sources

• osv: GHSA-vxqx-rh46-q2pg
• https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg
• https://nvd.nist.gov/vuln/detail/CVE-2026-25480
• https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca
• https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0
• https://github.com/litestar-org/litestar
• https://github.com/litestar-org/litestar/releases/tag/v2.20.0

CVE-2026-25480 · published 2026-02-09T17:19:06Z · modified 2026-07-13T07:26:32.411208744Z · JSON