CVE-2026-54282 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Attackers can spoof the request hostname in Starlette by manipulating the path, potentially bypassing host-based security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54282?
CVE-2026-54282 is a low-severity vulnerability in Kludex starlette, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.
Weakness: CWE-706
Which versions are affected by CVE-2026-54282?
3 open source packages ship an affected version, including starlette and Starlette. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
starlette PyPI | All versions | 1.3.0 |
starlette PyPI | All versions | 1.3.0 |
Starlette PyPI | All versions | 1.3.0 |
Linux distribution packages (1)
python-starlette openSUSE:Tumbleweed | All versions | 1.3.1-1.1 |
Products include Encode Starlette.
How do I fix CVE-2026-54282?
Upgrade starlette to 1.3.0 or later.
Is CVE-2026-54282 being exploited?
There is no known exploitation of CVE-2026-54282 in the wild and no public exploit code.
Other vulnerabilities in Kludex starlette
- CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling
- CVE-2026-54283 Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
- CVE-2026-48818 Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
- CVE-2023-29159 Starlette has Path Traversal vulnerability in StaticFiles
- CVE-2023-30798 MultipartParser DOS with too many fields or files in Starlette Framework
Sources
Also known as CLEANSTART-2026-EW07034, CLEANSTART-2026-PS49478, CLSA-2026-1784077472, DEBIAN-CVE-2026-54282, ECHO-c63d-05ac-97df, GHSA-jp82-jpqv-5vv3 and 21 more.