CVE-2026-54282: Starlette Request URL Hostname Spoofing Vulnerability

Technical summary

The vulnerability stems from how Starlette reconstructs the request URL by concatenating scheme, host, and path components before re-parsing them. RFC 3986 defines the authority boundary with clear syntax; however, when a path parameter lacks the required leading slash, the re-parsing step shifts the authority boundary, causing HTTP request path content to become part of the parsed hostname. This occurs because the naive string concatenation followed by URL re-parsing doesn't validate the path format before assembly. An attacker can craft a request with a malicious path like /[email protected] to cause request.url.hostname to reflect the injected host. The vulnerability affects code paths that call request.url.hostname rather than reading the authoritative Host header from request.headers or accessing scope['server'][0].

Business impact

Organizations using Starlette for HTTP request handling face a risk of host header spoofing if their application logic relies on request.url.hostname for security decisions. This could enable attackers to bypass hostname-based access controls, forge request origins in logging or audit trails, or circumvent Host header validation in API gateway configurations. The impact is limited to applications that actively trust the reconstructed URL hostname without additional verification, but such patterns are not uncommon in authentication filters, CORS validation, or multi-tenant routing logic.

Affected systems

Starlette framework versions prior to 1.3.0 are affected. This includes all 1.2.x, 1.1.x, 1.0.x and earlier releases. The Encode project maintains Starlette as a foundational ASGI toolkit used directly in production applications and as a dependency in other frameworks. Users running Starlette-based applications should verify their installed version immediately.

Exploitability

Exploitation requires network access to the Starlette application and the ability to craft HTTP requests with non-standard path formats. The attack complexity is rated as high because the malicious path must be properly formed to trigger the parsing boundary shift, and the application must explicitly trust request.url.hostname in a security-relevant context. An attacker cannot exploit this remotely against a patched version. The CVSS score of 3.7 reflects the limited scope (only applications reading the reconstructed URL hostname) and the conditional nature of the flaw (requires code to actually misuse the value).

Remediation

Upgrade Starlette to version 1.3.0 or later, which includes path validation before URL reconstruction. For applications that cannot immediately upgrade, the primary mitigation is to audit code for any reliance on request.url.hostname and replace such checks with explicit Host header validation via request.headers.get('host') or direct scope inspection. Consider implementing a Web Application Firewall rule to reject requests with non-standard path encoding or authority injection patterns.

Patch guidance

Update Starlette to 1.3.0 or later. For most projects, this is a standard dependency update: pip install --upgrade starlette>=1.3.0 or update your requirements.txt or pyproject.toml accordingly. Verify against the official Encode Starlette release notes to confirm your version includes the fix. No special configuration changes are required post-patch.

Detection guidance

Monitor HTTP access logs for requests containing unusual path formats, particularly those with @ characters or authority-like syntax in the path component (e.g., /[email protected]). Check application logs for hostname validation mismatches between the Host header and any logged request.url.hostname values. Review code repositories for patterns where request.url.hostname, request.url.netloc, or request.url.authority are used in authentication, authorization, or routing decisions without independent Host header verification. Intrusion detection systems can flag requests where the path portion contains authority-like characters.

Why prioritize this

Although the CVSS score is low (3.7), this vulnerability deserves immediate attention because it directly undermines hostname validation, a fundamental security boundary in web applications. The flaw is subtle—developers may not realize their use of request.url.hostname is unsafe—and the exploit is trivial once the vulnerability is understood. Prioritize patching in applications exposed to untrusted clients or used in multi-tenant environments where host-based isolation is a control.

Risk score, explained

The CVSS 3.1 score of 3.7 is rated LOW with a network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). The high complexity reflects the requirement for both a correctly-formed malicious path and vulnerable application code that trusts the reconstructed URL. The integrity impact is limited to potential spoofing of the request origin; no data is leaked or system availability compromised. In practice, risk depends heavily on your application's specific use of request.url.hostname.

Frequently asked questions