GHSA-93ph-p7v4-hwh4
Medium · 6.5CVSS
6.5
EPSS
—
Published
Feb 9, 2026
CISA due date
—
The record
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | litestar | 2.19.0 | 2.20.0 |
Related vulnerabilities
- CVE-2026-25479 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Same vulnerability
- CVE-2026-25480 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- CVE-2026-25478 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- GHSA-vxqx-rh46-q2pg Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning… Also affects litestar
- GHSA-2p2x-hpg8-cqp2 Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in… Also affects litestar
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-185
- CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect… CWE-185
- CVE-2026-73425 Astro is a web framework for content-driven websites. CWE-185