AIKIDO-2026-10923
starlette is vulnerable to Improper Input Validation
95
Critical Risk
This Affects:
starletteTL;DR
Affected versions are vulnerable to improper Host header validation when reconstructing request.url. A crafted Host header containing path or query delimiters can cause request.url.path to differ from the actual requested path, potentially allowing attackers to bypass path-based security checks or authorization middleware.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
starlette is vulnerable to Improper Input Validation in versions 0.8.3 - 1.0.0.
How to fix this
Upgrade the starlette library to the patch version.
Links
GitHub Release
Other
badhost.org
github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yamlostif.org/disclosing-the-badhost-vulnerability-in-starlettesecwest.net/starlettex41-dsec.de/lab/advisories/x41-2026-002-starletteaccess.redhat.com/errata/RHSA-2026:22992access.redhat.com/errata/RHSA-2026:22993access.redhat.com/errata/RHSA-2026:23346access.redhat.com/errata/RHSA-2026:24866access.redhat.com/errata/RHSA-2026:26226access.redhat.com/errata/RHSA-2026:30088access.redhat.com/errata/RHSA-2026:30089access.redhat.com/errata/RHSA-2026:34456access.redhat.com/errata/RHSA-2026:34526access.redhat.com/errata/RHSA-2026:34532access.redhat.com/errata/RHSA-2026:37275access.redhat.com/errata/RHSA-2026:43038access.redhat.com/errata/RHSA-2026:44696access.redhat.com/errata/RHSA-2026:51357access.redhat.com/security/cve/CVE-2026-48710bugzilla.redhat.com/show_bug.cgi?id=2481742security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant