SB20261106115 - Debian update for starlette

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261106115

SB20261106115 - Debian update for starlette

Published: November 6, 2026

Security Bulletin ID SB20261106115
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Unsafe reflection (CVE-ID: CVE-2026-48817)

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to invoke unintended endpoint methods.

The vulnerability exists due to use of externally-controlled input to select code in HTTPEndpoint request dispatch when processing a request with a non-standard HTTP method. A remote attacker can send a specially crafted request to invoke unintended endpoint methods.

Exploitation requires an HTTPEndpoint subclass to be registered through Route(...) without an explicit methods= argument, and the subclass must expose additional methods whose names match a non-standard HTTP method token shape, accept a single request argument, and return a response.


2) Input validation error (CVE-ID: CVE-2026-54282)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to poison the hostname trusted by Starlette middleware or error handlers.

The vulnerability exists due to URL reconstruction concatenating an unvalidated path directly after the host when an ASGI server forwards request targets lacking a leading slash. An unauthenticated remote attacker can submit such a target to mislead hostname-based security decisions before routing or in error handlers, provided no intermediary rejects it and application code trusts the reconstructed URL.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-54283)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause denial of service in Starlette applications that parse URL-encoded form requests.

The vulnerability exists due to Starlette's URL-encoded parser ignoring max_fields and max_part_size limits when applications call request.form() on application/x-www-form-urlencoded requests. An unauthenticated remote attacker can submit excessive fields or an oversized field to block the worker's event loop or force unbounded memory allocation, making the service unavailable through parallel requests.


Remediation

Install update from vendor's website.

References