Detections
Analytics
SCA: security update for starlette (GHSA-86qp-5c8j-p5mr)
medium Tenable Cloud Security Plugin ID 442645
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header
was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on
the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make
`request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply
security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be
bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the
`Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and
falls back to `scope["server"]` for malformed values. (CVE-2026-48710)
Solution
Update the starlette library and its related packages to version 1.0.1 or later.See Also
Plugin Details
Severity: Medium
ID: 442645
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 6/4/2026
Updated: 7/10/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
Percentile: 96.36
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-48710
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/4/2026
Vulnerability Publication Date: 5/26/2026
Reference Information
CVE: CVE-2026-48710