By vendor

Encode vulnerabilities

Known CVEs affecting Encode products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-48818HIGH 7.5

  Starlette, a popular lightweight web framework used by FastAPI and other applications, has a vulnerability in how it handles file serving on Windows systems. When serving static files, the framework can be tricked into initiating SMB (network file sharing) connections to attacker-controlled servers by requesting UNC paths like \\attacker.com\share. Even though the HTTP response is a 404 error, the vulnerability exposes the Windows service account's NTLMv2 credentials during this failed connection attempt. These credentials can then be cracked offline or used in relay attacks. The flaw does not affect Linux/Unix systems or configurations where symlink following is explicitly enabled.

• CVE-2026-54283HIGH 7.5

  Starlette, a popular lightweight Python web framework, has a vulnerability in how it handles form submissions. When developers configure size limits to protect their applications from being overwhelmed by large requests, those limits fail to work for one common type of form submission (URL-encoded forms). An attacker can exploit this by sending an extremely large or complex form to crash or degrade the application's performance, even when administrators thought they had protective limits in place. The issue affects versions 0.4.1 through 1.3.0 and is fixed in version 1.3.1.

• CVE-2026-48817MEDIUM 5.3

  Starlette versions 1.0.1 and earlier have a flaw in how they route HTTP requests to handler methods. When an endpoint class is set up without explicitly listing allowed HTTP methods, the framework will accept any HTTP verb and attempt to call it as a method on the endpoint object. An attacker can exploit this by sending requests with crafted HTTP methods that match internal helper methods on the endpoint, bypassing authorization checks that would normally protect those methods. FastAPI applications built on vulnerable Starlette versions are also affected. This issue is fixed in Starlette 1.1.0.

• CVE-2026-54282LOW 3.7

  Starlette versions prior to 1.3.0 contain a flaw in how they reconstruct the request URL from incoming HTTP requests. When a malicious HTTP request contains a path that doesn't start with a forward slash (such as @google.com), the URL parsing logic gets confused about where the authority (hostname) section ends and treats attacker-supplied content as the hostname. Applications that trust the reconstructed request.url.hostname value instead of validating the actual Host header can be tricked into accepting requests as if they came from a different domain. An attacker could exploit this to bypass hostname-based access controls or mislead applications in authentication decisions.