CVE-2026-48710
This vulnerability (CVE-2026-48710) in Starlette versions before 1.0.1 deserves more attention than its CVSS 6.5 suggests. The core issue is a silent divergence between two path representations: `scope['path']` used for routing, and `request.url.path` used by your application's security logic. An attacker can send a malformed Host header that causes these to disagree — a request hitting `/admin` routes correctly while `request.url.path` reports something else entirely, with no error, no exception, nothing logged. Most application security checks are written against `request.url.path`, not `scope`. Path-based authorization, redirects, CORS validation, and traversal guards all assume this property reflects what was actually requested. This vulnerability breaks that assumption silently. Your security check isn't failing — it's operating on attacker-controlled data. The fix makes the fallback deterministic by using `scope['server']` when Host header validation fails, but this doesn't eliminate the divergence — it only makes it predictable. The deeper architectural problem is that ASGI never defined which path representation is authoritative, and Starlette's fix implicitly codifies `scope['path']` as the routing truth while leaving `request.url.path` as a reconstructed convenience property. If you maintain Starlette-based applications, audit any security decisions that rely on `request.url.path`, `request.url`, or related URL properties. Those checks should reference `scope['path']` instead. This is especially critical if your auth layer runs after routing — the CVSS 6.5 assumes that ordering, but many applications don't enforce it. The real impact ceiling is bounded only by what your path-based security controls protect. Be aware this vulnerability class has precedent in Django and Flask. The pattern recurs: frameworks expose parallel representations of the same resource for ergonomics, developers choose the cleaner one for security decisions, and attackers manipulate the translation layer between them. Review your dependencies and middleware — any library using reconstructed URLs for security boundaries carries this latent risk.
Reviewed through automated stages and approved by a human before publication.