CVE-2026-48710: Starlette Host Header Smuggling Flaw Added to CISA KEV — Patch to 1.0.1+

TL;DR

CVE-2026-48710 is an HTTP request/response smuggling weakness in Kludex's Starlette ASGI framework that lets an unauthenticated attacker inject path content into the Host header so that request.url.path diverges from the path the router actually dispatched. Any application that makes authentication or authorization decisions from the reconstructed URL — rather than the raw ASGI scope path — can be bypassed, and the flaw is reported to be chainable with CVE-2026-42271. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a remediation due date of 2026-09-16; upgrade Starlette to 1.0.1 or later, or enforce strict Host header validation at the edge until you can.

What is this vulnerability?

Field	Value
CVE	CVE-2026-48710
Vulnerability name	Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Vendor / product	Kludex / Starlette
Weakness	CWE-444 (Inconsistent Interpretation of HTTP Requests)
Affected versions	Starlette prior to 1.0.1 (all releases below the fix)
Fixed version	Starlette 1.0.1 and later
CISA KEV added	2026-09-02
CISA remediation due date	2026-09-16
Known ransomware use	Unknown
CVSS 3.1	6.5 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD, GitHub Security Advisories, and a third-party scoring source agree)
EPSS	~0.363 (98th percentile)
Public exploit / PoC references	2 GitHub references (a host-header lab and a supply-chain guard project)

Overview

CVE-2026-48710 is a trust-boundary mismatch inside Starlette, the lightweight ASGI framework and toolkit maintained by Kludex. Before version 1.0.1, Starlette reconstructed request.url by combining the client-supplied Host header with the request path, without first validating that header against the grammar defined in RFC 9112 §3.2 and RFC 3986 §3.2.2. Because the router matches on the raw HTTP path while request.url is rebuilt from the Host value, a malformed header can make request.url.path differ from the path that was actually requested. The practical consequence is that middleware and endpoints which apply security restrictions based on request.url — rather than the raw scope path — can be bypassed.

The flaw affects Starlette releases prior to 1.0.1. The fix, shipped in 1.0.1, validates the Host header against the RFC grammar when constructing request.url and falls back to scope["server"] for malformed values. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a remediation deadline of 2026-09-16, and the CISA summary notes that the vulnerability could be chained with CVE-2026-42271. NVD, GitHub Security Advisories, and a third-party scoring source all rate it CVSS 3.1 6.5 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, while EPSS sits at roughly 0.363 — the 98th percentile — indicating elevated near-term exploitation interest.

Why should defenders care about a medium-severity framework bug? Because Starlette is a widely embedded dependency rather than a standalone product. The true blast radius depends on every downstream framework, gateway, and internal service that imports it, and the vulnerable code may be present in applications that never reference Starlette directly in their own manifests. Treat this as a supply-chain-relevant issue: inventory first, then patch. Anyone running FastAPI-style stacks, ASGI middleware, or reverse proxies that forward to Starlette-based backends should prioritize both.

Technical details

The root cause is a disagreement between two representations of the same request. Starlette's router matches on the raw HTTP path taken from the ASGI scope, but request.url is reconstructed by concatenating the Host header with that path and re-parsing the result. Before 1.0.1, the Host header was not validated against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 before being used in that reconstruction. An attacker who supplies a crafted Host value can therefore cause request.url.path to resolve to something other than the path that was actually routed. This is a textbook inconsistent-interpretation condition (CWE-444): two components disagree about what the request target is.

• Vulnerable component: Starlette's URL construction logic in request handling, specifically the use of the unvalidated Host header when rebuilding request.url.
• Affected range: all Starlette versions below 1.0.1.
• Fixed behavior: 1.0.1 validates the Host header against the RFC grammar and falls back to scope["server"] for malformed values.
• Attack prerequisites: network reachability to the affected service and the ability to control the Host header — normal for any direct HTTP client. No authentication, user interaction, or special privileges are required per the CVSS vector (PR:N, UI:N).
• Network exposure: any HTTP listener backed by a Starlette-based ASGI application, including services behind reverse proxies or load balancers that pass the client Host header through unchanged.
• Chainability: the issue is reported to be chainable with CVE-2026-42271, so a single deployment may be exposed to a multi-step attack rather than an isolated bug.

The security-relevant pattern to hunt for is any code path where the router's decision and the security control's decision are derived from different sources. If your middleware reads request.url or request.url.path, it is reading the reconstructed value; if it reads the raw scope path, it is reading what the router actually dispatched.

Impact

Successful abuse yields limited but meaningful confidentiality and integrity impact (C:L / I:L per CVSS) with no direct availability effect. The most realistic outcome is authentication and authorization bypass: middleware or endpoints that enforce restrictions by inspecting request.url — rather than the raw scope path — can be tricked into evaluating a different path than the one the router actually dispatched. That opens the door to reaching protected routes, skipping path-based allow/deny rules, or confusing logging and audit pipelines that record the reconstructed URL instead of the true request target.

Because the reconstructed URL is frequently what gets written to access logs, WAF rules, and rate limiters, an attacker can also poison detection and correlation data. A request that appears in the log as hitting a benign path may in fact have been dispatched to a sensitive handler. In a chained scenario with CVE-2026-42271, the smuggling primitive could serve as a stepping stone toward broader access — the CISA summary explicitly flags the chain, and public research has discussed escalation paths in AI gateway deployments.

Business exposure scales with two variables: how much of an organization's authentication logic depends on request.url semantics, and how many internet-facing ASGI services are running unpatched Starlette underneath other frameworks. Organizations with centralized, scope-based authorization are far less exposed than those with per-endpoint URL checks scattered across middleware.

Exploitability

CVE-2026-48710 is on the CISA KEV catalog as of 2026-09-02, which is the strongest available signal that exploitation has been observed in the wild. EPSS sits at approximately 0.363, the 98th percentile, indicating elevated near-term exploitation interest independent of the KEV listing. Two public GitHub references have circulated — a host-header lab and a supply-chain guard project — suggesting that defenders and researchers are building hands-on test environments and dependency-checking tooling rather than weaponized exploits.

The reported chainability with CVE-2026-42271 is a recurring theme in public discussion: smuggling primitives are most dangerous when combined with a second weakness that converts a bypass into something more consequential. Known ransomware use is listed as unknown, so there is no confirmed ransomware association to weigh at this time. The combination of KEV status, a 98th-percentile EPSS score, and a short remediation window is what should drive prioritization here — not the 6.5 base score alone.

KEV vs CVSS vs EPSS

Signal	What it measures	Action for this CVE
CISA KEV	Confirmed in-the-wild exploitation, with a binding remediation deadline for covered federal assets	Treat as exploited. Remediate by 2026-09-16 per BOD 26-04 guidance; evaluate internet exposure per asset.
CVSS 3.1 (6.5, MEDIUM)	Intrinsic technical severity of the flaw in isolation	Useful for understanding the primitive (network-reachable, no auth, low C/I impact) but understates urgency when chained or when URL-based auth is in play.
EPSS (~0.363, 98th percentile)	Probability of exploitation activity in the near term	Reinforces the KEV signal. Prioritize inventory and patching ahead of lower-EPSS backlog items.

Exploitation steps (defensive triage)

This is a defensive triage framing, not a weaponized recipe. Work through these steps in order and record evidence at each stage.

1. Inventory. Enumerate all services and container images that resolve Starlette below 1.0.1, including transitive dependencies pulled in by higher-level frameworks. SBOM and dependency-scanning output is the fastest starting point.
2. Exposure check. Identify which of those services are internet-facing or reachable from untrusted networks, and flag any that sit behind reverse proxies or load balancers that pass the client Host header through unchanged.
3. Code review. Review authentication, authorization, and routing middleware for any logic that reads request.url or request.url.path instead of the raw ASGI scope path. These are the controls that can be bypassed.
4. Log hunt. Correlate access logs for requests where the logged URL path does not match the route that was actually served, or where the Host value contains unexpected characters, slashes, or encoded segments.
5. Edge telemetry. Check WAF and proxy logs for malformed or duplicated Host headers, absolute-form request targets, and unusual casing or whitespace around the header value.
6. Chain assessment. Determine whether CVE-2026-42271 is also present in the same environment, since the two are reported to be chainable.
7. Patch and verify. Apply the vendor fix or compensating controls, then re-test the affected auth paths to confirm the bypass no longer reproduces. Re-scan images to confirm the fixed Starlette version is actually shipped.

Indicators of compromise

• Access log entries where the recorded URL path diverges from the route that produced the response, or where request.url-derived fields disagree with the raw request line.
• Host headers containing path separators, @, encoded characters, absolute URLs, or unexpected whitespace and casing.
• Multiple Host headers in a single request, or a Host that does not match the expected service hostname for that listener.
• Authentication or authorization decisions logged against a path that was never routed to the corresponding handler.
• Sudden 200/302 responses to endpoints that should have returned 401/403 based on path rules.
• WAF or proxy alerts for request smuggling patterns, header normalization mismatches, or conflicting Content-Length/Transfer-Encoding handling on the same connection.
• EDR or runtime telemetry showing ASGI worker processes handling requests whose reconstructed URL does not correspond to any configured route.
• Spikes in requests to admin, internal, or debug paths originating from clients that previously only touched public endpoints.

Mitigation and workarounds

Primary remediation: upgrade Starlette to version 1.0.1 or later, which validates the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 and falls back to scope["server"] for malformed values. Because Starlette is commonly a transitive dependency, update the top-level framework (for example FastAPI-style stacks) and rebuild container images so the fixed version is actually shipped — a manifest change that never reaches the running image does not reduce risk.

Compensating controls where immediate upgrade is not possible:

• Enforce strict Host header validation at the edge: reject requests with malformed, duplicated, or unexpected Host values, and normalize headers before they reach the ASGI application.
• Configure reverse proxies and load balancers to set a trusted Host rather than passing client values through verbatim.
• Audit authentication and authorization middleware to depend on the raw scope path instead of request.url where feasible.

Per CISA's BOD 26-04 guidance, evaluate internet exposure for each asset and either apply mitigations or discontinue use of the affected component if no fix is available. Given the KEV listing and the 2026-09-16 due date, treat remediation as time-bound and track completion per asset, not per project. After patching, re-scan and re-test the affected auth paths to confirm the bypass no longer reproduces.

Community reactions

The disclosure drew attention primarily because of the CISA KEV listing and the short remediation window rather than a large volume of public exploit tooling. Community discussion has centered on the supply-chain angle: Starlette is rarely deployed alone, so the practical question is which downstream frameworks and services inherit the vulnerable URL construction. The two public GitHub references that have circulated — a host-header lab and a supply-chain guard project — point to defenders building test environments and dependency-checking tooling rather than weaponized exploits. The reported chainability with CVE-2026-42271 has also been a recurring theme, with analysts noting that smuggling primitives are most dangerous when combined with a second weakness. Overall sentiment is that the CVSS 6.5 rating understates operational urgency for organizations with URL-based authorization logic.

FAQ

Is CVE-2026-48710 in the CISA KEV catalog? Yes. CISA added it on 2026-09-02.

What is the remediation due date? 2026-09-16, per the KEV entry. Covered federal assets should follow BOD 26-04 guidance; other organizations should treat the date as a prioritization anchor.

Does this affect internet-facing systems? The CVSS vector is AV:N with no authentication required, so any reachable Starlette-based HTTP service is in scope. The CISA required action explicitly asks stakeholders to evaluate each asset's internet exposure.

Which products are affected? Starlette itself prior to 1.0.1, plus any downstream framework, gateway, or internal service that embeds it. Because it is a transitive dependency, the vulnerable code may be present in applications that never reference Starlette directly.

How do I verify remediation? Confirm that the running artifact resolves Starlette 1.0.1 or later — not just that a manifest was updated — then re-test the affected authentication and authorization paths to confirm the bypass no longer reproduces.

Can it be chained with other vulnerabilities? Yes. The CISA summary notes it could be chained with CVE-2026-42271, so assess both in the same environment.

Related resources

• GitHub Security Advisory GHSA-86qp-5c8j-p5mr
• NVD entry for CVE-2026-48710
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• Public research lab (host header)
• Public supply-chain tooling reference