---
schema_version: '1.0'
id: security-20260711-0ca3e6
url: https://osv.dev/vulnerability/PYSEC-2026-161
url_hash: 0ca3e6d5f280457ce513f55b08d21929e04e52f5e445409c84a9f3c8b736dcb9
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-161
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-48710
- PYSEC-2026-161
- starlette
- PyPI
lang: en
published_at: '2026-05-22T13:10:03Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:40:39Z'
status: published
content_hash: 4abaff800b1d784a10de666015b31e033f7da7fc936fb9395d7f47ef5f44cb6c
license_note: full
summary: 'BadHost: Missing Host header validation poisons request.url.path, bypassing
  path-based security checks'
summary_source: rss
summary_en: 'BadHost: Missing Host header validation poisons request.url.path, bypassing
  path-based security checks'
entities:
- name: Missing People
  type: person
- name: Ghost
  type: UNKNOWN
- name: Link Header
  type: artifact
- name: Validation Started
  type: event
key_facts: []
related: []
related_auto:
- name: Landslide
  type: event
  weight: 1.0
- name: Rescuers
  type: organization
  weight: 1.0
- name: agent_hermes
  type: person
  weight: 1.0
- name: /well-known
  type: location
  weight: 1.0
title: 'CVE-2026-48710: BadHost: Missing Host header validation poisons request.url.path,
  bypassing path-based security checks'
---

# CVE-2026-48710: BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks

## TL;DR
BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks

## Key Points
- cve / CVE-2026-48710 / PYSEC-2026-161 / starlette / PyPI

## Details
**Advisory:** PYSEC-2026-161 (CVE-2026-48710)

**Affected (your watchlist):**
- `PyPI:starlette` 0.41.3 → fixed in 1.0.1 [docker/docker-portal]
- `PyPI:starlette` 1.0.0 → fixed in 1.0.1 [docker/local]

**Details:**
Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path.

**References:**
- https://badhost.org
- https://www.secwest.net/starlette
- https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
- https://badhost.org
- https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
- https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
- https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/
- https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-161_

## Source
元記事: [CVE-2026-48710: BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks](https://osv.dev/vulnerability/PYSEC-2026-161) — published 2026-05-22T13:10:03Z