---
schema_version: '1.0'
id: security-20260711-d36fb6
url: https://osv.dev/vulnerability/PYSEC-2026-248
url_hash: d36fb607b764c184a8ccd1534027d9b3174f7b7245257376a7dd115682461447
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-248
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-54282
- PYSEC-2026-248
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- starlette
- PyPI
lang: en
published_at: '2026-06-22T18:16:46Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:40:39Z'
status: published
content_hash: ce99813db935b58dfda6a7068af16ffba04720dacc8ed5c96255516a339e6a85
license_note: full
summary: Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP
  request path is not validated before being used to reconstruct request.url. Because
  request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the
  result, a path that does not begin wi
summary_source: rss
summary_en: Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the
  HTTP request path is not validated before being used to reconstruct request.url.
  Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing
  the result, a path that does not begin wi
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-54282 — starlette
---

# CVE-2026-54282 — starlette

## TL;DR
Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin wi

## Key Points
- cve / CVE-2026-54282 / PYSEC-2026-248 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N / starlette / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
**Advisory:** PYSEC-2026-248 (CVE-2026-54282)

**Affected (your watchlist):**
- `PyPI:starlette` 0.41.3 → fixed in 1.3.0 [docker/docker-portal]
- `PyPI:starlette` 1.0.0 → fixed in 1.3.0 [docker/local]
- `PyPI:starlette` 1.1.0 → fixed in 1.3.0 [docker/mac]

**Details:**
Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.

**References:**
- https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-248_

## Source
元記事: [CVE-2026-54282 — starlette](https://osv.dev/vulnerability/PYSEC-2026-248) — published 2026-06-22T18:16:46Z