CVE-2026-54282: Kludex Starlette hostname spoofing via unvalidated request path

CVE-2026-54282 · Severity: low · CVSS 3.7 · Published 2026-06-22

Starlette is a popular toolkit used by developers to build web services in Python. A flaw in how it handles web addresses allows an attacker to send a specially crafted request that tricks the system into misidentifying which website or server the request is intended for. This could lead to security bypasses in custom software that relies on this information for making security decisions, such as verifying where a user is being redirected.

Technologies: Kludex Starlette, starlette (PyPI). Vendors: Kludex, PyPI.

Quick answers

Is CVE-2026-54282 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54282 being exploited in the wild.
How severe is CVE-2026-54282?
Low severity, with a CVSS score of 3.7, published 22 June 2026.
Which products and versions are affected?
Kludex Starlette < 1.3.0; starlette (PyPI) ECOSYSTEM:introduced=0,fixed=1.3.0.
Is there a fix for CVE-2026-54282?
Yes. starlette (PyPI): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54282 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54282?
Check whether you run Kludex Starlette or starlette (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • starlette (PyPI): upgrade to 1.3.0 or later
    pip install "starlette>=1.3.0"

Technical details

A vulnerability exists in Starlette's URL reconstruction logic where the HTTP request path is concatenated with the scheme and host without proper validation. If an attacker provides a path that does not start with a forward slash (e.g., '@attacker.com'), the re-parsing of the resulting URL string moves the authority boundary, causing 'request.url.hostname' to be controlled by the attacker rather than reflecting the actual 'Host' header. This requires an ASGI server that passes malformed request targets into the 'scope'. Exploitation is primarily limited to middleware or exception handlers that process 'request.url' before routing, as these malformed paths typically result in a 404 error. The issue is resolved in version 1.3.0.

Affected products

  • Kludex Starlette < 1.3.0

Identifiers

  • CVE-2026-54282
  • GHSA-jp82-jpqv-5vv3
  • PYSEC-2026-248

Timeline

  • 2026-06-11: advisory: GitHub Security Advisory published by Kludex
  • 2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.