PyPI/starlette CVE-2026-48817: medium 5.3, EPSS 0.21%

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attr

Action: Upgrade starlette to 1.1.0 or later.

pip install starlette==1.1.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2280
• https://github.com/Kludex/starlette/releases/tag/1.1.0
• https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c

CVE-2026-48817 · published 2026-06-17T20:17:22.427Z · modified 2026-07-13T07:15:42.498495396Z · JSON