CVE-2026-25480 FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

Medium 6.5 Published 9 Feb 2026 Updated 10 Feb 2026

Attackers can poison the response cache in Litestar by exploiting key collisions, causing users to receive incorrect cached data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-25480?

CVE-2026-25480 is a medium-severity vulnerability in litestar-org litestar, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0.

Weakness: CWE-176

Which versions are affected by CVE-2026-25480?

3 open source packages ship an affected version, including litestar. It affects 1 product.

Package	Affected	Fixed in
`litestar` PyPI	All versions	`2.20.0`
`litestar` PyPI	From `2.19.0`	`2.20.0`
`litestar` PyPI	From `2.19.0`	`2.20.0`

Products include Litestar Litestar.

How do I fix CVE-2026-25480?

Upgrade litestar to 2.20.0 or later.

Is CVE-2026-25480 being exploited?

There is no known exploitation of CVE-2026-25480 in the wild and no public exploit code.

Sources

Also known as GHSA-vxqx-rh46-q2pg, PYSEC-2026-2197.