Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-48710 · Microsoft / collected KEV context

cve-program · CVE-2026-48710

• https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
• https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
• https://badhost.org/
• https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
• https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
• https://www.secwest.net/starlette
• https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette

No related operational record is retained in the current change model.