starlette: Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks (moderate). GHSA-86qp-5c8j-p5mr, CVE-2026-48710, PYSEC-2026-161, X41-2026-002.
osv.devquote checked- security advisory
- Your codeby hand
Nemotron fixes
In its own wordsmatches the page ✓
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
What Teire looks for in your code
nothing to search for: checked by hand
Does it reach your code?