CVE catalog
CVE-2026-48710
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorith
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- Exploitation
- CISA Known Exploited Vulnerabilities
- EPSS
- 70.29% · Oct 25, 2026
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | starlette | sid | 1.9.0-1 | fixed |
| Debian | starlette | forky | 1.9.0-1 | fixed |
| Debian | starlette | trixie | 0.46.1-3+deb13u3 | fixed |
| Debian | starlette | trixie-security | 0.46.1-3+deb13u3 | fixed |
| Debian | starlette | bookworm | 0.26.1-1+deb12u1 | fixed |
| Debian | starlette | bookworm-security | 0.26.1-1+deb12u2 | fixed |
| Cpe | starlette | Not reported | 1.0.1 | fixed |
| Cpe | starlette | Not reported | 1.0.1 | fixed |
| Cpe | ai_inference_server | Not reported | Not reported | unknown |
| Cpe | ansible_automation_platform | Not reported | Not reported | unknown |
| Cpe | migration_toolkit_for_applications | Not reported | 8.2.0 | fixed |
| Cpe | openshift_ai | Not reported | 3.4.2 | fixed |
| Cpe | openshift_lightspeed | Not reported | Not reported | unknown |
| Cpe | satellite | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_ai | Not reported | Not reported | unknown |
| PyPI | starlette | Not reported | 1.0.1 | fixed |
| Opensuse | python-google-adk | tumbleweed | 2.2.0-1.1 | fixed |
| Opensuse | python-starlette | tumbleweed | 1.2.0-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | starlette | source | sid | 1.1.0-1 | not yet assigned | Not reported | [1137375] |
| Debian | starlette | source | forky | 1.1.0-1 | not yet assigned | Not reported | [1137375] |
| Debian | starlette | source | trixie | 0.46.1-3+deb13u2 | not yet assigned | Not reported | [1137375] |
| Debian | starlette | source | bookworm | 0.26.1-1+deb12u1 | not yet assigned | Not reported | [1137375] |
| Cpe | starlette | cpe | Not reported | 1.0.1 | Not reported | Not reported | Not reported |
| Cpe | starlette | cpe | Not reported | 1.0.1 | Not reported | NVD-CVE-2026-48710 | Not reported |
| Cpe | migration_toolkit_for_applications | cpe | Not reported | 8.2.0 | Not reported | NVD-CVE-2026-48710 | Not reported |
| Cpe | openshift_ai | cpe | Not reported | 3.4.2 | Not reported | NVD-CVE-2026-48710 | Not reported |
| PyPI | starlette | PyPI | Not reported | 1.0.1 | Not reported | GHSA-86QP-5C8J-P5MR | Not reported |
| Opensuse | python-google-adk | rpm | tumbleweed | 2.2.0-1.1 | Not reported | OPENSUSE-SU-2026:11044-1 | Not reported |
| Opensuse | python-starlette | rpm | tumbleweed | 1.2.0-1.1 | Not reported | OPENSUSE-SU-2026:11026-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [python313-google-adk]Unknown
Source package: [python-google-adk]
Details (1)
2.2.0-1.2· noarch · tumbleweedUnknown · Fixed:
2.2.0-1.1Version impact unknown
nvd · python-google-adk · opensuse · tumbleweed
- [python313-starlette]Unknown
Source package: [python-starlette]
Details (1)
1.6.0-1.1· noarch · tumbleweedUnknown · Fixed:
1.2.0-1.1Version impact unknown
nvd · python-starlette · opensuse · tumbleweed
- [python314-google-adk]Unknown
Source package: [python-google-adk]
Details (1)
2.2.0-1.2· noarch · tumbleweedUnknown · Fixed:
2.2.0-1.1Version impact unknown
nvd · python-google-adk · opensuse · tumbleweed
- [python314-starlette]Unknown
Source package: [python-starlette]
Details (1)
1.6.0-1.1· noarch · tumbleweedUnknown · Fixed:
1.2.0-1.1Version impact unknown
nvd · python-starlette · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [python3-starlette]Fixed
Source package: [starlette]
Details (4)
0.26.1-1+deb12u1· all · bookwormFixed · Fixed:
0.26.1-1+deb12u1nvd · starlette · debian · bookworm; nvd · starlette · debian · 12
0.26.1-1+deb12u1· all · bookwormFixed · Fixed:
0.26.1-1+deb12u1nvd · starlette · debian · bookworm; nvd · starlette · debian · 12
0.26.1-1+deb12u2· all · bookworm-securityFixed · Fixed:
0.26.1-1+deb12u1nvd · starlette · debian · bookworm; nvd · starlette · debian · 12
0.26.1-1+deb12u2· all · bookworm-securityFixed · Fixed:
0.26.1-1+deb12u1nvd · starlette · debian · bookworm; nvd · starlette · debian · 12
[Debian 13 (Trixie)]
- [python3-starlette]Fixed
Source package: [starlette]
Details (5)
0.46.1-3+deb13u2· all · trixieFixed · Fixed:
0.46.1-3+deb13u2nvd · starlette · debian · 13
0.46.1-3+deb13u2· all · trixieFixed · Fixed:
0.46.1-3+deb13u2nvd · starlette · debian · 13
0.46.1-3+deb13u2· all · trixie-security · Historical versionFixed · Fixed:
0.46.1-3+deb13u2nvd · starlette · debian · 13
0.46.1-3+deb13u3· all · trixie-securityFixed · Fixed:
0.46.1-3+deb13u2nvd · starlette · debian · 13
0.46.1-3+deb13u3· all · trixie-securityFixed · Fixed:
0.46.1-3+deb13u2nvd · starlette · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20975-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-48710]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-48710]
- [https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11026-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11044-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-48710]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
[CISA Known Exploited Vulnerabilities (OSINT)] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]