Input validation error in starlette - CVE-2026-48710
Published: May 22, 2026 / Updated: May 27, 2026
Vulnerability identifier: #VU132131
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48710
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass path-based security checks.
The vulnerability exists due to improper input validation in request.url reconstruction when processing a malformed Host header. A remote attacker can send a specially crafted Host header to bypass path-based security checks.
The issue occurs because routing uses the raw HTTP path while security-sensitive code may rely on request.url.path reconstructed from the Host header.
Affected software
starlette
Debian Linux
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
starlette (Debian package)
python-starlette
Debian Linux
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
starlette (Debian package)
python-starlette
How to mitigate CVE-2026-48710
Install security update from vendor's website.
starlette - update to 1.0.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.4.0 Patch 3
starlette (Debian package) - addressed in versions 0.26.1-1+deb12u1, 0.46.1-3+deb13u2
python-starlette - addressed in versions 0.52.1-2.fc43, 0.52.1-2.fc44
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.4.0 Patch 3
starlette (Debian package) - addressed in versions 0.26.1-1+deb12u1, 0.46.1-3+deb13u2
python-starlette - addressed in versions 0.52.1-2.fc43, 0.52.1-2.fc44