# CVE-2026-48817: starlette: Starlette is a lightweight ASGI framework/toolkit

CVE-2026-48817 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-48817, released June 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-48817
- Priority: Routine
- CVSS: 5.3 (medium)
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 17, 2026

## Description

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-starlette opensuse-leap 16.0 | 0.41.3-160000.4.1 | [OPENSUSE-SU-2026:21053-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21053-1.md) | Jun 24, 2026 |
| Linux | python-starlette sles 16.0 | 0.41.3-160000.4.1 | [SUSE-SU-2026:22360-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22360-1.md) | Jun 24, 2026 |
| Linux | starlette Debian 12.15 (bookworm) | 0.26.1-1+deb12u2 | [DEBIAN-CVE-2026-48817](https://patchblox.com/security/data/fix/linux/debian-cve-2026-48817.md) | Jun 24, 2026 |
| Linux | starlette Debian 13.5 (trixie) | 0.46.1-3+deb13u3 | [DEBIAN-CVE-2026-48817](https://patchblox.com/security/data/fix/linux/debian-cve-2026-48817.md) | Jun 24, 2026 |
| Linux | starlette Debian 14 | 1.1.0-1 | [DEBIAN-CVE-2026-48817](https://patchblox.com/security/data/fix/linux/debian-cve-2026-48817.md) | Jun 24, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.