Starlette Vulnerability Allows Path Injection via Host Header

A vulnerability in Starlette, a Python ASGI framework, allows attackers to manipulate the Host header, leading to potential authentication bypass and other security issues. The flaw arises from Starlette's failure to validate the Host header value, enabling path injection into the reconstructed URL. This inconsistency can affect middleware implementations in various open-source projects that rely on the request.url for security checks. The vulnerability has been assigned the identifier PYSEC-2026-161. Affected systems include those using Starlette and FastAPI. A proof of concept (PoC) has been created, and a patch was publicly released on May 21, 2026. Security professionals are advised to review their implementations and apply the patch promptly.

Key Points: • Starlette's Host header validation flaw can lead to authentication bypass. • The vulnerability affects middleware in popular open-source projects relying on request.url. • A patch was released on May 21, 2026, following the identification of the issue.