---
schema_version: '1.0'
id: security-20260711-b55652
url: https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3
url_hash: b55652aa52bcd59ea84f979dc54a830cebf7ba83e4234a7ed8b6b9c38bc0c965
canonical_url: https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54282
- GHSA-jp82-jpqv-5vv3
- severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- starlette
- PyPI
lang: en
published_at: '2026-06-15T20:38:08Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-16T06:46:07Z'
status: published
content_hash: 38242620323a15ea7514fcd6db11e9ec61e22ecbeccfd658463624e407604274
license_note: full
summary: 'Starlette: Unvalidated request path concatenated into authority poisons
  request.url.hostname'
summary_source: rss
summary_en: 'Starlette: Unvalidated request path concatenated into authority poisons
  request.url.hostname'
entities:
- name: Starlette
  type: organization
- name: Requested command
  type: method
- name: OCTOPATH TRAVELER
  type: artifact
related_auto:
- name: Hermes
  type: artifact
  weight: 2.0
- name: hermes
  type: bot
  weight: 1.0
title: 'CVE-2026-54282: Starlette: Unvalidated request path concatenated into authority
  poisons request.url.hostname'
---

# CVE-2026-54282: Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

## TL;DR
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

## Key Points
- cve / CVE-2026-54282 / GHSA-jp82-jpqv-5vv3 / severity:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N / starlette / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
**Advisory:** GHSA-jp82-jpqv-5vv3 (CVE-2026-54282)

**Affected (your watchlist):**
- `PyPI:starlette` 0.41.3 → fixed in 1.3.0 [docker/docker-portal]
- `PyPI:starlette` 1.0.0 → fixed in 1.3.0 [docker/local]
- `PyPI:starlette` 1.1.0 → fixed in 1.3.0 [docker/mac]

**Details:**
### Summary

In affected versions, the HTTP request path is not validated before being used to reconstruct `request.url`. Because `request.url` is rebuilt by concatenating `{scheme}://{host}{path}` and re-parsing the result, a path that does not begin with `/` (for example `@google.com`) moves the authority boundary during re-parsing, so `request.url.hostname` and `request.url.netloc` become attacker-controlled. Code that reads `request.url.hostname` (rather than the `Host` header or `scope`) can therefore be misled into trusting an attacker-supplied host.

### Details

When a client requests a path that does not start with `/`:

```http
GET @google.com HTTP/1.1
Host: localhost
```

affected versions reconstruct the URL as `http://localhost@google.com`. Per [RFC 3986 §3.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1), the substring before `@` in the authority is `userinfo`, so re-parsing yields `username = "localhost"` and `hostname = "google.com"`, with an empty path:

```text
request.url          == "http://localhost@google.com"
request.url.hostname == "google.com"
request.url.path     == ""
```

The root cause is that the path is concatenated directly after the host without a separating `/`, and without validating that it begins with one. Only the `Host` header was validated when constructing `request.url`; the path was not.

This requires an ASGI server that forwards a request-target lacking a leading `/` into `scope["path"]`.

### Impact

Any application running an affected version that uses `request.url`, `request.url.netloc`, or `request.url.hostname` for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first.

Note that this is less exploitable than [GHSA-86qp-5c8j-p5mr](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr): there, the poison is carried in the `Host` header, so the real path still routes to a valid endpoint while `request.url.path` lies. Here, the poison must be carried in the path itself, and that path (`@google.com`) does not match any registered route, so routing returns `404` and no endpoint handler runs. The exposure is limited to code that reads `request.url` before routing - notably middleware - or in 404/exception handlers.

### Mitigation

Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields `http://localhost/@google.com` with `request.url.hostname == "localhost"`.

**References:**
- https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3
- https://nvd.nist.gov/vuln/detail/CVE-2026-54282
- https://github.com/Kludex/starlette
- https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-248.yaml

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3_

## Source
元記事: [CVE-2026-54282: Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname](https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3) — published 2026-06-15T20:38:08Z