CVE-2026-48710

CVE-2026-48710 المبدأ: Starlette هو إطار عمل Python ASGI مفتوح المصدر وخفيف الوزن. ينبع من أن إطار Starlette، عند معالجة بنية بيانات الـ url، يثق في قيمة host التي يرسلها العميل ويضمّنها مباشرة في متغير الـ url للاستخدام لاحقًا في التحقق من الصلاحيات. يُعالَج الـ url الأصلي في...

Starlette - Improper Validation of Unsafe Equivalence in Input

A flaw was found in Starlette, a lightweight ASGI Asynchronous Server Gateway Interface framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading...

LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - SQLAdmin ajaxlookup Authorization Bypass कार्यकारी सारांश इस रिपॉजिटरी में CVE-2026-46645 को पुन: उत्पन्न करने के लिए एक स्थानीय Docker लैब शामिल है, जो SQLAdmin के ajaxlookup एंडपॉइंट को प्रभावित करने वाली एक प्राधिकरण बाईपास भेद्यता है। SQLAdmin Starlette और FastAPI अनुप्रयोगों...

BadHost-CVE-2026-48710-Exploit

BadHost — ماسح CVE-2026-48710 ماسح للتحقق من ثغرة تجاوز المصادقة BadHost في Starlette / FastAPI — حيث يقرأ middleware المصادقة request.url.path بدلاً من request.scope"path"، مما يتيح تزوير رأس Host لتهريب مسار مسموح به وتجاوز المصادقة. root@kitploit: GET /admin HTTP/1.1 Host:...

starlette-host-header-lab

Starlette Host-Header URL Confusion Lab X41-2026-002 Автономный, контейнеризированный учебный лабораторный стенд, воспроизводящий уязвимость обхода аутентификации в Starlette, раскрытую X41 D-Sec. Консультация: X41-2026-002 GHSA: GHSA-86qp-5c8j-p5mr CWE: 436 — Конфликт интерпретации / Недоверенны...

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

SummaryGlances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead o...

PYSEC-2026-3667 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Summary Glances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead ...

Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

CLSA-2026-1781052728 TuxCare security update for starlette (1 CVE)

TuxCare rebuilt starlette to address 1 CVE. Fixed in 0.27.0.post3+tuxcare...

CLSA-2026-1769040755 TuxCare security update for starlette (1 CVE)

TuxCare rebuilt starlette to address 1 CVE. Fixed in 0.13.6.post2+tuxcare...

ROOT-APP-PYPI-CVE-2026-48818 CVE-2026-48818 in rootio-starlette - Patched by Root

Root has patched CVE-2026-48818 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-54282 CVE-2026-54282 in rootio-starlette - Patched by Root

Root has patched CVE-2026-54282 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48817 CVE-2026-48817 in rootio-starlette - Patched by Root

Root has patched CVE-2026-48817 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-54283 CVE-2026-54283 in rootio-starlette - Patched by Root

Root has patched CVE-2026-54283 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48710 CVE-2026-48710 in rootio-starlette - Patched by Root

Root has patched CVE-2026-48710 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to HTTP Request/Response Smuggling in Starlette [CVE-2026-48710]

Summary IBM Watson Speech Services Cartridge is vulnerable to HTTP Request/Response Smuggling in Starlette, due to a routing algorithm which relies on the raw HTTP path while request.url is rebuilt from the Host header, potentially allowing a malformed header to make request.url.path differ from...

ROOT-APP-PYPI-CVE-2025-62727 CVE-2025-62727 in rootio-starlette - Patched by Root

Root has patched CVE-2025-62727 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-54121 CVE-2025-54121 in rootio-starlette - Patched by Root

Root has patched CVE-2025-54121 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-47874 CVE-2024-47874 in rootio-starlette - Patched by Root

Root has patched CVE-2024-47874 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...