Skip to content
Starlette Vulnerability Allows Path Injection via Host Header

Starlette Vulnerability Allows Path Injection via Host Header

First seen 27 May 2026, 08:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •May 28, 2026 at 07:41 UTC
  • •Starlette's Host header validation flaw can lead to authentication bypass.
  • •The vulnerability affects middleware in popular open-source projects relying on request.url.
  • •A patch was released on May 21, 2026, following the identification of the issue.

A vulnerability in Starlette, a Python ASGI framework, allows attackers to manipulate the Host header, leading to potential authentication bypass and other security issues. The flaw arises from Starlette's failure to validate the Host header value, enabling path injection into the reconstructed URL. This inconsistency can affect middleware implementations in various open-source projects that rely on the request.url for security checks. The vulnerability has been assigned the identifier PYSEC-2026-161. Affected systems include those using Starlette and FastAPI. A proof of concept (PoC) has been created, and a patch was publicly released on May 21, 2026. Security professionals are advised to review their implementations and apply the patch promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 105d ago How this analysis works

Timeline

2026-01-27
Issue identified during code audit
The vulnerability was discovered during an unrelated source code audit of Starlette.
x41-dsec.de
2026-02-04
PoC created and vendor contacted
A proof of concept was developed and shared with the vendor for review.
x41-dsec.de
2026-03-01
Patch proposed by the vendor
The vendor proposed a patch to address the identified vulnerability in Starlette.
x41-dsec.de
2026-05-21
Patch publicly released
The vendor released a public patch to fix the vulnerability in Starlette.
x41-dsec.de
2026-05-27
Advisory released
An advisory detailing the vulnerability and its implications was published.
x41-dsec.de

More articles in this cluster (3)

Extracted Entities (6)

1 / 3