PyPI/starlette CVE-2026-48710: unknown, exploited, EPSS 7.06%
BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks
Action: Upgrade starlette to 1.0.1 or later.
pip install starlette==1.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.1 | - |
Fixed versions
| 1.0.1 |
Sources
- osv: PYSEC-2026-161
- kev: CVE-2026-48710
- https://badhost.org
- https://www.secwest.net/starlette
- https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
- https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
- https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/
- https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
CVE-2026-48710 · published · modified · JSON