CVE-2026-25479
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Feb 9, 2026
CISA due date
—
The record
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | litestar | 2.19.0 | 2.20.0 |
Related vulnerabilities
- GHSA-93ph-p7v4-hwh4 Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in… Same vulnerability
- CVE-2026-25480 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- CVE-2026-25478 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- GHSA-vxqx-rh46-q2pg Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning… Also affects litestar
- GHSA-2p2x-hpg8-cqp2 Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in… Also affects litestar
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-185
- CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect… CWE-185
- CVE-2026-73425 Astro is a web framework for content-driven websites. CWE-185