[pkg-vuln] CVE-2026-48817 in starlette@0.52.1 #541

New Issue

kert · 2026-07-10T01:31:29Z

kert commented

2026-07-10 01:31:29 +00:00

Severity: MEDIUM
Package: starlette @ 0.52.1
Fixed in: 1.1.0

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-48817

**Severity:** MEDIUM **Package:** `starlette` @ `0.52.1` **Fixed in:** `1.1.0` Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-48817

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-07-10 01:31:29 +00:00

kert added the quality ci labels 2026-07-10 01:31:29 +00:00

kert commented

2026-07-10 17:19:04 +00:00

Not exploitable here. CVE-2026-48817 affects HTTPEndpoint class-based views dispatching via getattr; the api uses only FastAPI decorated routes, no HTTPEndpoint (grep clean). starlette enters via fastapi (api service) and marimo (notebooks editor). Neither container publishes a host port (compose.yml: only traefik/git/zotero do); both are reachable only on internal compose networks / behind traefik, and the api requires bearer auth on protected routes.

Bumped anyway (defense in depth): starlette 0.52.1 → 1.3.1 in 65c31cf88f (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

**Not exploitable here.** CVE-2026-48817 affects `HTTPEndpoint` class-based views dispatching via `getattr`; the api uses only FastAPI decorated routes, no `HTTPEndpoint` (grep clean). starlette enters via fastapi (api service) and marimo (notebooks editor). Neither container publishes a host port (compose.yml: only traefik/git/zotero do); both are reachable only on internal compose networks / behind traefik, and the api requires bearer auth on protected routes. **Bumped anyway** (defense in depth): `starlette` 0.52.1 → 1.3.1 in https://git.fhirworx.io/homelab/stack/commit/65c31cf88fd8de552a006859159790de468403fb (uv.lock + pkg-manifest; pyproject floor raised for direct deps). Advisory link is in the issue body.

kert closed this issue

2026-07-10 17:19:05 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#541