Input validation error in starlette - CVE-2026-54282
Published: November 6, 2026
Vulnerability identifier: #VU159847
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54282
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to poison the hostname trusted by Starlette middleware or error handlers.
The vulnerability exists due to URL reconstruction concatenating an unvalidated path directly after the host when an ASGI server forwards request targets lacking a leading slash. An unauthenticated remote attacker can submit such a target to mislead hostname-based security decisions before routing or in error handlers, provided no intermediary rejects it and application code trusts the reconstructed URL.
Affected software
starlette
Debian Linux
starlette (Debian package)
Debian Linux
starlette (Debian package)
How to mitigate CVE-2026-54282
Install security update from vendor's website.
starlette - update to 1.3.0
starlette (Debian package) - update to 0.46.1-3+deb13u3
starlette (Debian package) - update to 0.46.1-3+deb13u3