Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler. An application (including Starlette-based frameworks like FastAPI) is affected if it registers an HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra methods named like non-standard HTTP verbs that take one request argument and return a response. This issue has been fixed in version 1.1.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a     request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute     with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass     is registered through Route(...) without an explicit methods= argument, the route does not constrain the     method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches     an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a     request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such     as internal helpers, without the authorization checks applied by the intended public handler. An     application (including Starlette-based frameworks like FastAPI) is affected if it registers an     HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra     methods named like non-standard HTTP verbs that take one request argument and return a response. This     issue has been fixed in version 1.1.0. (CVE-2026-48817)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a
    request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute
    with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass
    is registered through Route(...) without an explicit methods= argument, the route does not constrain the
    method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches
    an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a
    request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such
    as internal helpers, without the authorization checks applied by the intended public handler. An
    application (including Starlette-based frameworks like FastAPI) is affected if it registers an
    HTTPEndpoint subclass via Route(...) without explicitly setting methods=, and that subclass includes extra
    methods named like non-standard HTTP verbs that take one request argument and return a response. This
    issue has been fixed in version 1.1.0. (CVE-2026-48817)

ID	Name	Product	Family	Severity
321665	Linux Distros Unpatched Vulnerability : CVE-2026-48817	Nessus	Misc.	medium
443228	SCA: security update for starlette (GHSA-x746-7m8f-x49c)	Tenable Cloud Security	SCA Checks	medium
443228	SCA: security update for starlette (GHSA-x746-7m8f-x49c)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-48817

medium

Tenable Plugins

medium

medium

medium