---
schema_version: '1.0'
id: security-20260711-fa0f6a
url: https://osv.dev/vulnerability/GHSA-x746-7m8f-x49c
url_hash: fa0f6a17b685f0ec000eb6991e8847c0d1ae300af7bdd14a12945dfddde4efa1
canonical_url: https://osv.dev/vulnerability/GHSA-x746-7m8f-x49c
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-48817
- GHSA-x746-7m8f-x49c
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- starlette
- PyPI
lang: en
published_at: '2026-06-15T20:16:05Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:40:39Z'
status: published
content_hash: e2bf3f51bac25ca647c845e8af45adacfafb0b4ca35c0d6a3dee4526c6318ff3
license_note: full
summary: 'Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes
  via `getattr`'
summary_source: rss
summary_en: 'Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes
  via `getattr`'
entities:
- name: https://deploymentsafety.openai.com/gpt-5-6/gpt-5-6.pdf
  type: artifact
- name: Method
  type: UNKNOWN
key_facts: []
related: []
related_auto:
- name: CoT(Chain of Thought
  type: UNKNOWN
  weight: 1.0
- name: SustainableTech
  type: concept
  weight: 1.0
- name: agent_e_bot
  type: organization
  weight: 1.0
title: 'CVE-2026-48817: Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint`
  attributes via `getattr`'
---

# CVE-2026-48817: Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

## TL;DR
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

## Key Points
- cve / CVE-2026-48817 / GHSA-x746-7m8f-x49c / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N / starlette / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
**Advisory:** GHSA-x746-7m8f-x49c (CVE-2026-48817)

**Affected (your watchlist):**
- `PyPI:starlette` 0.41.3 → fixed in 1.1.0 [docker/docker-portal]
- `PyPI:starlette` 1.0.0 → fixed in 1.1.0 [docker/local]

**Details:**
### Summary

When dispatching a request, `HTTPEndpoint` selects the handler by lowercasing the HTTP method and looking it up as an attribute with `getattr`, without restricting the lookup to a known set of HTTP verbs.

When an `HTTPEndpoint` subclass is registered through `Route(...)` without an explicit `methods=` argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler.

### Details

`HTTPEndpoint` uses the client-supplied method name to resolve an instance attribute, without validating it against the set of HTTP verbs the endpoint supports. A method such as `_DO_DELETE` therefore resolves an attribute like `_do_delete` and invokes it. Non-standard methods are valid [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#name-method) token methods, so an endpoint must not treat the method name as a trusted attribute selector.

### Impact

An application is affected when all of the following hold:

* It defines an `HTTPEndpoint` subclass and registers it via `Route(...)` without an explicit `methods=` argument.
* The subclass defines additional methods whose names match a non-standard HTTP-method token shape and that accept a single `request` argument and return a response.

This also affects frameworks built on Starlette, like FastAPI.

### Mitigation

Register `HTTPEndpoint` subclasses with an explicit `methods=` argument on the `Route`, listing only the HTTP verbs the endpoint supports. The route then rejects any other method with `405 Method Not Allowed` before it reaches the endpoint, so non-standard methods cannot resolve an attribute.

**References:**
- https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c
- https://nvd.nist.gov/vuln/detail/CVE-2026-48817
- https://github.com/Kludex/starlette
- https://github.com/Kludex/starlette/releases/tag/1.1.0

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-x746-7m8f-x49c_

## Source
元記事: [CVE-2026-48817: Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`](https://osv.dev/vulnerability/GHSA-x746-7m8f-x49c) — published 2026-06-15T20:16:05Z