CVE-2026-25480

The record

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0.

Affected packages

Related vulnerabilities

• GHSA-vxqx-rh46-q2pg Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning… Same vulnerability
• CVE-2026-25479 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
• CVE-2026-25478 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
• GHSA-93ph-p7v4-hwh4 Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in… Also affects litestar
• GHSA-2p2x-hpg8-cqp2 Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in… Also affects litestar
• CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
• CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
• CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176