By vendor

Encode vulnerabilities

Known CVEs affecting Encode products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-48818HIGH 7.5

  Starlette, a popular lightweight web framework used by FastAPI and other applications, has a vulnerability in how it handles file serving on Windows systems. When serving static files, the framework can be tricked into initiating SMB (network file sharing) connections to attacker-controlled servers by requesting UNC paths like \\attacker.com\share. Even though the HTTP response is a 404 error, the vulnerability exposes the Windows service account's NTLMv2 credentials during this failed connection attempt. These credentials can then be cracked offline or used in relay attacks. The flaw does not affect Linux/Unix systems or configurations where symlink following is explicitly enabled.

• CVE-2026-48817MEDIUM 5.3

  Starlette versions 1.0.1 and earlier have a flaw in how they route HTTP requests to handler methods. When an endpoint class is set up without explicitly listing allowed HTTP methods, the framework will accept any HTTP verb and attempt to call it as a method on the endpoint object. An attacker can exploit this by sending requests with crafted HTTP methods that match internal helper methods on the endpoint, bypassing authorization checks that would normally protect those methods. FastAPI applications built on vulnerable Starlette versions are also affected. This issue is fixed in Starlette 1.1.0.