CVE-2026-48710

What it actually does

Malformed Host header allows reconstruction of request.url with a path differing from the raw HTTP path used for routing, enabling bypass of security logic that inspects request.url rather than scope path.

Why it matters to the business

Organizations face risk of unauthorized access to protected endpoints and resources; active exploitation in the wild combined with CISA KEV deadline of 2026-09-16 demands immediate remediation to avoid breaches and compliance issues.

How an attack unfolds

Attacker supplies a crafted Host header that violates RFC grammar; Starlette rebuilds request.url from the header while routing uses the raw path, creating a mismatch that bypasses middleware or endpoint checks relying on the reconstructed URL. Named threat actor Kludex Starlette HTTP Request/Response Smuggling Vulnerability has been observed leveraging this in the wild.

How to fix it

Upgrade encode/starlette to version 1.0.1 or later; the release validates the Host header per RFC 9112 §3.2 / RFC 3986 §3.2.2 and falls back to scope["server"] for invalid values.

How to confirm the fix worked

Confirm installed version is >= 1.0.1; test with malformed Host headers to ensure request.url.path matches the raw requested path or safely falls back without allowing bypass.

Typical attack path

1. Send HTTP request containing malformed Host header
2. Trigger path reconstruction in request.url that diverges from routed scope path
3. Bypass URL-based access control or authentication middleware
4. Reach protected endpoints or data

How to detect it

Inspect web server and application logs for requests containing Host headers that fail RFC grammar validation or produce request.url values inconsistent with the originally requested path; correlate with successful access to protected resources.

• Host header containing characters or formats violating RFC 9112 §3.2
• Log entries showing request.url.path differing from raw HTTP request path

What your security team should do

• Upgrade to Starlette >=1.0.1 immediately due to KEV listing and 2026-09-16 CISA deadline
• Review all middleware and endpoints that enforce security using request.url instead of raw scope path
• Implement WAF rules to normalize or reject non-compliant Host headers until patching is complete