litestar-org

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

litestar-org records in CISA KEV

No litestar-org vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Litestar 4 records HIGH

Records

9 records

TI-2024-21848 CVE-2024-32982 · GHSA-83pv-qr33-2vcf

Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

HIGH 77

Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00722 Published 2024-05-06 Fixed in 2.8.3, 2.7.2 +2 CWE-22

TI-2024-35241 CVE-2024-52581 · GHSA-gjcc-jvgw-wvwj

Litestar allows unbounded resource consumption (DoS vulnerability)

HIGH 75

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00794 Published 2024-11-20 Fixed in 2.13.0 CWE-770

TI-2025-36757 CVE-2025-59152 · GHSA-hm36-ffrh-c77c

X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

HIGH 72

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00485 Published 2025-10-06 Fixed in 2.18.0 CWE-807

TI-2026-35501 CVE-2026-48060 · GHSA-542p-wvx7-72m4

Litestar: HTML Injection Through CSRF Token

HIGH 70

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00352 Published 2026-07-28 Fixed in 2.20.0, 2.22.0 CWE-79

TI-2024-28356 CVE-2024-42370

Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow

HIGH 69

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00651 Published 2024-08-09 No fix listed CWE-78

TI-2026-35502 CVE-2026-48061 · GHSA-3qmc-cj7q-62hv

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

MEDIUM 60

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00375 Published 2026-08-03 Fixed in 2.22.0 CWE-644

TI-2026-20591 CVE-2026-25480 · GHSA-vxqx-rh46-q2pg

FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

LOW 35

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0046 Published 2026-02-09 Fixed in 2.20.0 CWE-176

TI-2026-20590 CVE-2026-25479 · GHSA-93ph-p7v4-hwh4

Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns

LOW 35

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00353 Published 2026-02-09 Fixed in 2.20.0 CWE-185

TI-2026-20589 CVE-2026-25478 · GHSA-2p2x-hpg8-cqp2

Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins

LOW 33

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00439 Published 2026-02-09 Fixed in 2.20.0 CWE-942

Open these records in search →