SB20261106111 - Multiple vulnerabilities in starlette

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261106111

SB20261106111 - Multiple vulnerabilities in starlette

Published: November 6, 2026

Security Bulletin ID SB20261106111
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Input validation error (CVE-ID: CVE-2026-54282)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to poison the hostname trusted by Starlette middleware or error handlers.

The vulnerability exists due to URL reconstruction concatenating an unvalidated path directly after the host when an ASGI server forwards request targets lacking a leading slash. An unauthenticated remote attacker can submit such a target to mislead hostname-based security decisions before routing or in error handlers, provided no intermediary rejects it and application code trusts the reconstructed URL.


Remediation

Install update from vendor's website.

References