Vulnerabilities

Security research · CVE-2026-54282

Unvalidated request path concatenated into authority poisons request.url.hostname

Published Jun 11, 2026 · catalog updated Jun 12, 2026 · Unvalidated request path concatenated

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-54282. EPSS is 0.27%. Act only if a listed version of Unvalidated request path concatenated is installed.

Severity

Low3.7

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.27%

Remediation

Version ranges on file

Affected products

pip Starlette

### Summary In affected versions, the HTTP request path is not validated before being used to reconstruct . Because is rebuilt by concatenating and re-parsing the result, a path that does not begin with (for example ) moves the authority boundary during re-parsing, so and become attacker-controlled. Code that reads (rather than the header or ) can therefore be misled into trusting an attacker-supplied host. ### Details When a client requests a path that does not start with : affected versions reconstruct the URL as . Per [RFC 3986 §3.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1), the substring before in the authority is , so re-parsing yields and , with an empty path: The root cause is that the path is concatenated directly after the host without a separating , and without validating that it begins with one. Only the header was validated when constructing ; the path was not. This requires an ASGI server that forwards a request-target lacking a leading into . ### Impact Any application running an affected version that uses , , or for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first. Note that this is less exploitable than [GHSA-86qp-5c8j-p5mr](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr): there, the poison is carried in the header, so the real path still routes to a valid endpoint while lies. Here, the poison must be carried in the path itself, and that path ( ) does not match any registered route, so routing returns and no endpoint handler runs. The exposure is limited to code that reads before routing - notably middleware - or in 404/exception handlers. ### Mitigation Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields with .