Kludex starlette up to 1.2.x HTTP Request request.url name resolution

Summaryinfo

A vulnerability labeled as problematic has been found in Kludex starlette up to 1.2.x. This vulnerability affects the function request.url of the component HTTP Request Handler. Executing a manipulation can lead to name resolution. This vulnerability is registered as CVE-2026-54282. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Kludex starlette up to 1.2.x. It has been declared as problematic. This vulnerability affects the function request.url of the component HTTP Request Handler. The manipulation with an unknown input leads to a name resolution vulnerability. The CWE definition for the vulnerability is CWE-706. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. As an impact it is known to affect integrity. CVE summarizes:

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-54282 since 06/12/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.3.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Kludex

Name

• starlette

Version

• 1.0
• 1.1
• 1.2

Website

• Product: https://github.com/Kludex/starlette/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion