CVE-2026-48817
published 2026-06-17CVE-2026-48817: Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.21%
11.5th percentile
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.
Affected
76 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-26 | mcp-tools-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | mcp-tools-rhel9 | — | — |
| encode | starlette | < 1.1.0 | 1.1.0 |
| encode | starlette | >= 0 < 1.1.0 | 1.1.0 |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| kludex | starlette | < 1.1.0 | 1.1.0 |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-cuda-rhel9 | — | — |
| rhaiis | vllm-neuron-rhel9 | — | — |
| rhaiis | vllm-rocm-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cvelistv5v3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods
vendor_redhat·2026-06-17·CVSS 5.3
CVE-2026-48817 [MEDIUM] CWE-749 starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods
starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods
A flaw was found in Starlette, a lightweight Asynchronous Server Gateway Interface (ASGI) framework. An attacker can exploit this vulnerability by sending a specially crafted HTTP request that uses a non-standard HTTP method. This can cause the framework to invoke internal methods not intended for public access, potentially leading to information disclosure or unintended execution of internal functions, bypassing authorization checks.
Statement: This is a Moderate impact flaw in Starlette, an ASGI framework, where an attacker can bypass authorization checks. By sending a specially crafted HTTP request with a non-standard method, an attacker can invoke internal methods not intended f
CVEList
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
cvelistv5·2026-06-17·CVSS 5.3
CVE-2026-48817 [MEDIUM] CWE-470 Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be H
GHSA
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
ghsa·2026-06-15
CVE-2026-48817 [MEDIUM] CWE-470 Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
### Summary
When dispatching a request, `HTTPEndpoint` selects the handler by lowercasing the HTTP method and looking it up as an attribute with `getattr`, without restricting the lookup to a known set of HTTP verbs.
When an `HTTPEndpoint` subclass is registered through `Route(...)` without an explicit `methods=` argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the auth
No detection rules found.
No public exploits indexed.
2026-06-17
Published