Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4711 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4711-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     August 01, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : starlette     Version        : 0.26.1-1+deb12u2     CVE ID         : CVE-2026-48817 CVE-2026-54282 CVE-2026-54283     Debian Bug     : 1140631 1140632

    Multiple vulnerabilities were found in starlette, a lightweight ASGI     (Asynchronous Server Gateway Interface) framework/toolkit.

    CVE-2026-48817

       A vulnerability exists where an HTTPEndpoint subclass is registered        through Route() without an explicit methods argument, and the route        does not constrain the method and every method reaches the endpoint.

    CVE-2026-54282

       A vulnerability exists where the HTTP request path is not validated        before being used to reconstruct request.url which can poison        request.url.hostname and request.url.netloc.

    CVE-2026-54283

       The max_fields and max_part_size limits for request.form() are enforced        for multipart/form-data, but silently ignored for application/x-www-        form-urlencoded.

    For Debian 12 bookworm, these problems have been fixed in version     0.26.1-1+deb12u2.

    We recommend that you upgrade your starlette packages.

    For the detailed security status of starlette please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/starlette

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a     request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute     with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass     is registered through Route(...) without an explicit methods= argument, the route does not constrain the     method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches     an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a     request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such     as internal helpers, without the authorization checks applied by the intended public handler. An     application (including Starlette-based frameworks like FastAPI) is affected if it registers an     HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra     methods named like non-standard HTTP verbs that take one request argument and return a response. This     issue has been fixed in version 1.1.0. (CVE-2026-48817)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a
    request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute
    with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass
    is registered through Route(...) without an explicit methods= argument, the route does not constrain the
    method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches
    an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a
    request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such
    as internal helpers, without the authorization checks applied by the intended public handler. An
    application (including Starlette-based frameworks like FastAPI) is affected if it registers an
    HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra
    methods named like non-standard HTTP verbs that take one request argument and return a response. This
    issue has been fixed in version 1.1.0. (CVE-2026-48817)

ID	Name	Product	Family	Type	Severity
331605	Debian dla-4711 : python3-starlette - security update	Nessus	Debian Local Security Checks	Local	medium
321665	Linux Distros Unpatched Vulnerability : CVE-2026-48817	Nessus	Misc.	Local	medium
443228	SCA: security update for starlette (GHSA-x746-7m8f-x49c)	Tenable Cloud Security	SCA Checks	Local	medium
443228	SCA: security update for starlette (GHSA-x746-7m8f-x49c)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-48817

medium

Tenable Plugins

medium

medium

medium

medium