{
  "cveId": "CVE-2026-48710",
  "url": "https://patchblox.com/security/cve/CVE-2026-48710",
  "summary": "CVE-2026-48710 is fixed in 4 products on 1 platform, first by FEDORA-2026-E0F378428E, released May 28, 2026. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on September 2, 2026. Patch Radar priority: Patch now.",
  "title": "starlette: Starlette is a lightweight ASGI framework/toolkit",
  "description": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP \u0060Host\u0060 request header was not validated before being used to reconstruct \u0060request.url\u0060. Because the routing algorithm relies on the raw HTTP path while \u0060request.url\u0060 is rebuilt from the \u0060Host\u0060 header, a malformed header could make \u0060request.url.path\u0060 differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on \u0060request.url\u0060 (rather than the raw \u0060scope\u0060 path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the \u0060Host\u0060 header against the grammar of RFC 9112 \u00A73.2 / RFC 3986 \u00A73.2.2 when constructing \u0060request.url\u0060 and falls back to \u0060scope[\u0022server\u0022]\u0060 for malformed values.",
  "published": "2026-05-26T22:16:44Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.70288,
  "epssPercentile": 0.99388,
  "priority": "Patch now",
  "priorityTier": 1,
  "exploited": true,
  "vendorExploited": false,
  "disclosed": false,
  "kev": {
    "added": "2026-09-02T00:00:00Z",
    "due": "2026-09-16T00:00:00Z",
    "ransomware": false,
    "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201CForensics Triage Requirements\u201D (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines."
  },
  "fixes": [
    {
      "platform": "linux",
      "product": "python-starlette",
      "release": "Fedora 43",
      "fixedVersion": "0.52.1-2.fc43",
      "fix": "FEDORA-2026-E0F378428E",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e0f378428e",
      "released": "2026-05-28T20:24:07Z"
    },
    {
      "platform": "linux",
      "product": "python-starlette",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.41.3-160000.3.1",
      "fix": "OPENSUSE-SU-2026:20975-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20975-1",
      "released": "2026-06-17T08:36:30Z"
    },
    {
      "platform": "linux",
      "product": "python-starlette",
      "release": "sles 16.0",
      "fixedVersion": "0.41.3-160000.3.1",
      "fix": "SUSE-SU-2026:22151-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22151-1",
      "released": "2026-06-17T08:36:56Z"
    },
    {
      "platform": "linux",
      "product": "python3-starlette",
      "release": "Fedora 43",
      "fixedVersion": "0.52.1-2.fc43",
      "fix": "FEDORA-2026-E0F378428E",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e0f378428e",
      "released": "2026-05-28T20:24:07Z"
    },
    {
      "platform": "linux",
      "product": "python3-starlette\u002Bfull",
      "release": "Fedora 43",
      "fixedVersion": "0.52.1-2.fc43",
      "fix": "FEDORA-2026-E0F378428E",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-e0f378428e",
      "released": "2026-05-28T20:24:07Z"
    },
    {
      "platform": "linux",
      "product": "starlette",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "0.26.1-1\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2026-48710",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48710",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "starlette",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.46.1-3\u002Bdeb13u2",
      "fix": "DEBIAN-CVE-2026-48710",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48710",
      "released": "2026-06-24T14:07:24Z"
    },
    {
      "platform": "linux",
      "product": "starlette",
      "release": "Debian 14",
      "fixedVersion": "1.1.0-1",
      "fix": "DEBIAN-CVE-2026-48710",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-48710",
      "released": "2026-06-24T14:07:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}