TI-2026-39182 Aliases CVE-2026-54282 GHSA-jp82-jpqv-5vv3

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

LOW 24CWE-706Published 2026-06-22 · Updated 2026-06-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00273 19th percentileScored 2026-11-07

Fix Partial starlette (Kludex): 1.3.0Starlette (PyPI): 1.3.0Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Kludex	starlette	before 1.3.0	1.3.0	Patch available	CNA
—	Starlette (PyPI)	before 1.3.0	1.3.0	Patch available	GHSA-jp82-jpqv-5vv3

starlette VendorKludex Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
Starlette (PyPI) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-jp82-jpqv-5vv3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:encode:starlette::::::python::*	before 1.3.0	Vulnerable	encode

cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* Versions before 1.3.0 Vulnerable ·encode

Remediation

Fix · CNA starlette (Kludex) Fixed in 1.3.0
Fix · GHSA-jp82-jpqv-5vv3 Starlette (PyPI) Fixed in 1.3.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Exploit Intelligence	Affected	No fix yet: Fix deferred
Migration Toolkit for Applications 8	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred

Not affected: 6 products

Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat Hardened Images
Red Hat OpenShift AI (RHOAI)
Red Hat Satellite 6

Timeline

2026-10-02 Threatist record created from CVE-2026-54282
2026-10-03 Alias added: GHSA-jp82-jpqv-5vv3

References

Advisory 2

Other 2

TI-2025-38917 Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse CVSS 3.1HIGH 7.5
TI-2026-30841 Python-Multipart: Denial of Service via unbounded multipart part headers CVSS 3.1HIGH 7.5
TI-2024-36140 python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences