CVE-2026-48061
CVE-2026-48061 · Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that strips X-Forwarded-Host, or when accepting HTTP/1.0 connections. This issue has been fixed in version 2.22.0.
CVSS 5.9 · Moyenne · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
litestar
- Versions du logiciel
- < 2.22.0: Concernée
Aucun correctif publié
litestar PyPI
- Versions du logiciel
- 1.0.0a0
- 2.0.0
- 2.0.0a3
- 2.0.0a4
- 2.0.0a5
- 2.0.0a6
- 2.0.0a7
- 2.0.0b1
- 2.0.0b2
- 2.0.0b3
- 2.0.0b4
- 2.0.0rc1
- 2.0.1
- 2.1.0
- 2.1.1
- 2.10.0
- 2.11.0
- 2.12.0
- 2.12.1
- 2.13.0
- 2.14.0
- 2.15.0
- 2.15.1
- 2.15.2
- 2.16.0
- 2.17.0
- 2.18.0
- 2.19.0
- 2.2.0
- 2.2.1
- 2.20.0
- 2.21.0
- 2.21.1
- 2.3.0
- 2.3.1
- 2.3.2
- 2.4.0
- 2.4.1
- 2.4.2
- 2.4.3
- 2.4.4
- 2.4.5
- 2.5.0
- 2.5.1
- 2.5.2
- 2.5.3
- 2.5.4
- 2.5.5
- 2.6.0
- 2.6.1
- 2.6.2
- 2.6.3
- 2.6.4
- 2.7.0
- 2.7.1
- 2.7.2
- 2.8.0
- 2.8.1
- 2.8.2
- 2.8.3
- 2.9.0
- 2.9.1
- Plages de versions concernées
- ECOSYSTEM: < 2.22.0
Mettez à jour vers 2.22.0