GHSA-vxqx-rh46-q2pg
Medium · 6.5CVSS
6.5
EPSS
—
Published
Feb 9, 2026
CISA due date
—
The record
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | litestar | 2.19.0 | 2.20.0 |
Related vulnerabilities
- CVE-2026-25480 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Same vulnerability
- CVE-2026-25479 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- CVE-2026-25478 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Also affects litestar
- GHSA-93ph-p7v4-hwh4 Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in… Also affects litestar
- GHSA-2p2x-hpg8-cqp2 Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in… Also affects litestar
- CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
- CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
- CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176