CVE-2026-48817
Full vulnerability record from the local CVENow database.
Description
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.
View original CVE JSON
{
"id": "CVE-2026-48817",
"sourceIdentifier": "[email protected]",
"published": "2026-06-17T20:17:22.427",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0."
},
{
"lang": "es",
"value": "Starlette es un framework/kit de herramientas ASGI ligero. En las versiones 1.0.1 e inferiores, al despachar una solicitud, HTTPEndpoint selecciona el gestor convirtiendo el método HTTP a minúsculas y buscándolo como un atributo con getattr, sin restringir la búsqueda a un conjunto conocido de verbos HTTP. Cuando una subclase de HTTPEndpoint se registra a través de Route(...) sin un argumento explícito methods=, la ruta no restringe el método y cada método llega al endpoint. Si un método HTTP no estándar cuyo nombre en minúsculas coincide con un atributo de la subclase del endpoint llega al endpoint, ese atributo se invoca como si fuera un gestor de solicitudes. Un atacante puede usar esto para acceder a métodos que nunca estuvieron destinados a ser gestores HTTP, como ayudantes internos, sin las comprobaciones de autorización aplicadas por el gestor público previsto. Una aplicación (incluidos frameworks basados en Starlette como FastAPI) se ve afectada si registra una subclase de HTTPEndpoint a través de Route(...) sin establecer explícitamente methods=, y esa subclase incluye métodos adicionales nombrados como verbos HTTP no estándar que toman un argumento de solicitud y devuelven una respuesta. Este problema ha sido solucionado en la versión 1.1.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Kludex",
"product": "starlette",
"versions": [
{
"version": "< 1.1.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-18T13:49:36.586536Z",
"id": "CVE-2026-48817",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-470"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*",
"versionEndExcluding": "1.1.0",
"matchCriteriaId": "DD48D170-564B-4AAB-8092-6DE121E58626"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/Kludex/starlette/releases/tag/1.1.0",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
}
]
}