Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Primary CVSS: v3.1 6.5 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.018390000 probability, percentile 0.767260000 (date 2026-07-24)

Problem Types: CWE-444 | CWE-1289 | CWE-444 CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CWE-1289 Improper Validation of Unsafe Equivalence in Input

Solutions

ADP: RHSA-2026:30089: Red Hat AI Inference Server 3.3

ADP: RHSA-2026:30088: Red Hat AI Inference Server 3.3

ADP: RHSA-2026:24866: Red Hat Ansible Automation Platform 2.6

ADP: RHSA-2026:23346: Red Hat Ansible Automation Platform 2.7

ADP: RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2

ADP: RHSA-2026:37275: Red Hat OpenShift AI 3.3

ADP: RHSA-2026:34456: Red Hat OpenShift AI 3.4

ADP: RHSA-2026:44696: Red Hat Satellite 6.17

ADP: RHSA-2026:22993: Red Hat Satellite 6.18

ADP: RHSA-2026:26226: Red Hat Satellite 6.18

ADP: RHSA-2026:22992: Red Hat Satellite 6.19

ADP: RHSA-2026:34532: Red Hat Satellite 6.19

ADP: RHSA-2026:34526: Red Hat Satellite 6.19

Workarounds

ADP: Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes. If custom middleware is present, it should be updated to use `request.scope["path"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.