CVE-2026-48710 in encode starlette
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Affected software: encode starlette, redhat ai inference server, redhat ansible automation platform, redhat migration toolkit for applications, redhat openshift ai, redhat openshift lightspeed, redhat satellite, redhat enterprise linux ai
Scores
- CVSS: 6.5 (medium)
- EPSS: 70.29% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-09-02
- Published: 2026-05-26
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): Yes, published
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.