CVE-2026-25479 Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns

Medium 6.5 Published 9 Feb 2026 Updated 10 Feb 2026

Attackers can bypass host validation in Litestar by exploiting unescaped regex metacharacters in allowlist patterns, requiring specific configuration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-25479?

CVE-2026-25479 is a medium-severity vulnerability in litestar-org litestar, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.

Weakness: CWE-185

Which versions are affected by CVE-2026-25479?

3 open source packages ship an affected version, including litestar. It affects 1 product.

Package	Affected	Fixed in
`litestar` PyPI	All versions	`2.20.0`
`litestar` PyPI	From `2.19.0`	`2.20.0`
`litestar` PyPI	From `2.19.0`	`2.20.0`

Products include Litestar Litestar.

How do I fix CVE-2026-25479?

Upgrade litestar to 2.20.0 or later.

Is CVE-2026-25479 being exploited?

There is no known exploitation of CVE-2026-25479 in the wild and no public exploit code.

Sources

Also known as GHSA-93ph-p7v4-hwh4, PYSEC-2026-2196.