{"action":"Upgrade starlette to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0"}],"component":"starlette","cve_ids":["CVE-2026-48710"],"ecosystem":"PyPI","epss":0.07056,"exploited":true,"fixed_versions":["1.0.1"],"ghsa_id":"GHSA-86qp-5c8j-p5mr","id":"tcs_01M5KGTMCEX7K94V2KB3MWHJ7R","modified_at":"2026-05-26T15:41:31.112064345Z","published_at":"2026-05-22T13:10:03Z","references":["https://osv.dev/vulnerability/PYSEC-2026-161","https://badhost.org","https://www.secwest.net/starlette","https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/","https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/","https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-161","url":"https://osv.dev/vulnerability/PYSEC-2026-161"},{"source":"kev","source_id":"CVE-2026-48710","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks"}