Starlette Security Middleware Bypass via Insufficient HTTP Host Header Validation (CVE-2026-48710)

1. Official Patch (Recommended)

Upgrade your Starlette dependency to version 1.0.1 or higher. This version validates the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 grammar and falls back to scope["server"] for malformed values.

# Using pip
pip install --upgrade "starlette>=1.0.1"

# Using Poetry
poetry add starlette@latest

2. Temporary Mitigation

If an immediate upgrade is not feasible, configure your reverse proxy (e.g., Nginx, AWS ALB) or WAF to validate and drop requests with malformed Host headers.

Nginx Configuration Example:

# Block requests with invalid Host headers
if ($http_host !~* ^[a-z0-9.-]+(:[0-9]+)?$) {
    return 400;
}

This vulnerability (CVE-2026-48710) exists in Starlette, a lightweight ASGI framework, due to the lack of validation on the HTTP Host request header before using it to reconstruct the request.url object.

While Starlette's routing algorithm relies on the raw HTTP path from the ASGI scope, many security middlewares and endpoints perform access control checks based on request.url. By sending a malformed Host header that violates RFC specifications, an attacker can manipulate the reconstruction of request.url, making request.url.path differ from the path that was actually requested and routed.

Consequently, security restrictions applied by middleware (such as IP/path-based access controls) can be completely bypassed. This vulnerability has been actively exploited in the wild (CISA KEV listed) with an EPSS score of 0.94, requiring immediate remediation.