Starlette is a lightweight ASGI framework/toolkit
Why It Matters
Analysis dossierWhy It Matters
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Immediate Attention
Yes
Unknown
Risk basis: CISA KEV exploitation signal; Microsoft or Microsoft-managed product relevance; Known exploitation signal from CISA KEV or ransomware metadata
Affected Products & Remediation
8 source-backed products- encode starlette · >= 0.8.3 < 1.0.1 · NVD CPE · Source
- redhat ai inference server · >= 3.3.0 <= 3.3.5 · NVD CPE · Source
- redhat ansible automation platform · 2.6; 2.7 · NVD CPE · Source
- redhat migration toolkit for applications · < 8.2.0 · NVD CPE · Source
- redhat openshift ai · >= 3.3 < 3.3.5; >= 3.4 < 3.4.2 · NVD CPE · Source
- redhat openshift lightspeed · version range not provided by source · NVD CPE · Source
- redhat satellite · 6.17; 6.18; 6.19 · NVD CPE · Source
- redhat enterprise linux ai · 3.0 · NVD CPE · Source
Vendor or catalog guidance (source)
- CISA KEV: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Listed
- Exploited (source statement)
- Yes
- Publicly disclosed (source)
- Unknown
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched kev-network-exposure (CVSS AV:N, CISA KEV Listed); network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)
Exposure
- Identify assets with the exact CVE and confirm the affected product/version against the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · KEV listing raises urgency, but inventory is needed to establish local exposure. · Rule kev-network-exposure
- Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated
Exploitation evidence
- Review relevant edge or application access logs for unusual requests around the advisory window.Telemetry: CommonSecurityLog · Log review is a hunting hypothesis; KEV listing alone does not show local exploitation. · Rule kev-network-exposure
Show more (2)
Exploitation evidence
- Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated
Response
- Recheck the affected assets after the source-stated mitigation or update is applied.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies local remediation. · Rule kev-network-exposure
CISA KEV Record
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Change History & Source Data
— No recorded material change
- CNA / source
- security-advisories@github.com
- Record status · verification
- NEW · CISA KEV confirmed
- CPE
- cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*, cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:*, cpe:2.3:a:redhat:ansible_automation_platform:2.6:-:*:*:*:*:*:*, cpe:2.3:a:redhat:ansible_automation_platform:2.7:-:*:*:*:*:*:*, cpe:2.3:a:redhat:migration_toolkit_for_applications:*:*:*:*:*:*:*:*, cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*, cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:*, cpe:2.3:a:redhat:satellite:6.17:*:*:*:*:*:*:*, cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*, cpe:2.3:a:redhat:satellite:6.19:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-48710"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descCorrelated briefings
— No published briefing references this CVE