Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

AEGLIX vulnerability intelligence

CVE-2026-48710

MEDIUM · CVSS 6.5 · Analyzed

Published: 2026-05-26 · Updated: 2026-10-01 · Source: NVD

Vulnerability overview

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Severity and scoring

CVSS score
6.5 · MEDIUM
CVSS version
3.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-1289, CWE-444

CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.

Known exploitation and remediation

Listed in CISA’s Known Exploited Vulnerabilities catalog.

Affected product
Kludex · Starlette
Added to catalog
2026-09-02
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA remediation due date
2026-09-16

CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.

Verify affected versions and patch availability in the vendor advisory before making changes.

Affected products and versions

  • cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*

    From (inclusive): 0.8.3

    Before (exclusive): 1.0.1

  • cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:*

    From (inclusive): 3.3.0

    Through (inclusive): 3.3.5

  • cpe:2.3:a:redhat:ansible_automation_platform:2.6:-:*:*:*:*:*:*

  • cpe:2.3:a:redhat:ansible_automation_platform:2.7:-:*:*:*:*:*:*

  • cpe:2.3:a:redhat:migration_toolkit_for_applications:*:*:*:*:*:*:*:*

    Before (exclusive): 8.2.0

  • cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*

    From (inclusive): 3.3

    Before (exclusive): 3.3.5

  • cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*

    From (inclusive): 3.4

    Before (exclusive): 3.4.2

  • cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:*

  • cpe:2.3:a:redhat:satellite:6.17:*:*:*:*:*:*:*

  • cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*

  • cpe:2.3:a:redhat:satellite:6.19:*:*:*:*:*:*:*

  • cpe:2.3:o:redhat:enterprise_linux_ai:3.0:*:*:*:*:*:*:*

These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.

Advisories and references

Explore official sources

Read the official NVD record ↗

Explore the CISA catalog ↗

Back to CVE intelligence