Kludex Starlette HTTP Request/Response Smuggling
CVE-2026-48710 is a medium-severity inconsistent interpretation of HTTP requests vulnerability in starlette from Kludex, with a CVSS 3.1 base score of 6.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected starlette versions: < 1.0.1. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on September 2, 2026, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update Migration Toolkit For Applications to 8.2.0 or a later version.
- Update Openshift Ai to 3.3.5 or 3.4.2, whichever matches your release line, or a later version.
- CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Read the advisory on github.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Kludex | starlette | < 1.0.1 | Not stated |
| Red Hat | Red Hat AI Inference Server 3.3 | Not specified in the record | Not stated |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | Not specified in the record | Not stated |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | Not specified in the record | Not stated |
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift AI 3.3 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift AI 3.4 | Not specified in the record | Not stated |
| Red Hat | Red Hat Satellite 6.17 | Not specified in the record | Not stated |
| Red Hat | Red Hat Satellite 6.18 | Not specified in the record | Not stated |
| Red Hat | Red Hat Satellite 6.19 | Not specified in the record | Not stated |
| Red Hat | Exploit Intelligence | Not specified in the record | Not stated |
| Red Hat | OpenShift Lightspeed | Not specified in the record | Not stated |
| Red Hat | Red Hat AI Inference Server | Not specified in the record | Not stated |
| Red Hat | Red Hat Ansible Automation Platform 2 | Not specified in the record | Not stated |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | Not specified in the record | Not stated |
| Red Hat | Red Hat OpenShift AI (RHOAI) | Not specified in the record | Not stated |
| Red Hat | Ai Inference Server | 3.3.0 through 3.3.5 | Not stated |
| Red Hat | Ansible Automation Platform | 2.6; 2.7 | Not stated |
| Red Hat | Migration Toolkit For Applications | before 8.2.0 | 8.2.0 |
| Red Hat | Openshift Ai | 3.3 up to, but not including, 3.3.5; 3.4 up to, but not including, 3.4.2 | 3.3.5, 3.4.2 |
| Red Hat | Satellite | 6.17; 6.18; 6.19 | Not stated |
| Red Hat | Enterprise Linux Ai | 3.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- LowSome restricted data can be read.
- Integrity
- LowLimited modification of data is possible.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 6.5 | Medium | CNA (github.com) |
| CVSS 3.1 | 6.5 | Medium | NVD |
| CVSS 3.1 | 6.5 | Medium | CNA |
Official description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Inconsistent Interpretation of HTTP Requests
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
How developers prevent this class of flaw
- Use a web server that employs a strict HTTP parsing procedure, such as Apache.
- Terminate the client session after each request.
More Inconsistent Interpretation of HTTP Requests vulnerabilities (CWE-444)
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: partial).
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- badhost.orgMitigation, Third Party Advisory
- github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
- ostif.org/disclosing-the-badhost-vulnerability-in-starletteMitigation, Third Party Advisory
- secwest.net/starletteExploit, Mitigation, Third Party Advisory
- x41-dsec.de/lab/advisories/x41-2026-002-starletteExploit, Mitigation, Third Party Advisory
Third-party and government advisories
- github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yamlThird Party Advisory
- access.redhat.com/errata/RHSA-2026:22992Third Party Advisory
- access.redhat.com/errata/RHSA-2026:22993Third Party Advisory
- access.redhat.com/errata/RHSA-2026:23346Third Party Advisory
- access.redhat.com/errata/RHSA-2026:24866Third Party Advisory
- access.redhat.com/errata/RHSA-2026:26226Third Party Advisory
- access.redhat.com/errata/RHSA-2026:30088Third Party Advisory
- access.redhat.com/errata/RHSA-2026:30089Third Party Advisory
- access.redhat.com/errata/RHSA-2026:34456Third Party Advisory
- access.redhat.com/errata/RHSA-2026:34526Third Party Advisory
- access.redhat.com/errata/RHSA-2026:34532Third Party Advisory
- access.redhat.com/errata/RHSA-2026:37275Third Party Advisory
- access.redhat.com/errata/RHSA-2026:43038Third Party Advisory
- access.redhat.com/errata/RHSA-2026:44696Third Party Advisory
- access.redhat.com/errata/RHSA-2026:51357Third Party Advisory
Technical write-ups (may include proof of concept)
- wiz.io/blog/ai-infrastructure-honeypotExploit, Third Party Advisory
Other vulnerabilities in starlette
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Recent Inconsistent Interpretation of HTTP Requests vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 9.1 Critical severity
- 9.8 Critical severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.