Litestar, an ASGI framework, versions before 2.22.0 have a vulnerability (CWE-644) where the AllowedHostsMiddleware improperly neutralizes HTTP headers for scripting syntax. Specifically, if the Host header is omitted, the middleware falls back to trusting the client-controllable X-Forwarded-Host header. This allows attackers to bypass allowed hosts validation by supplying a whitelisted domain in X-Forwarded-Host, enabling host header injection attacks including password reset poisoning, cache poisoning, and manipulation of server-side request routing. Applications using AllowedHostsConfig are affected if deployed without a reverse proxy that strips X-Forwarded-Host or when accepting HTTP/1.0 connections. The vulnerability is resolved in Litestar version 2.22.0.

An attacker can bypass allowed hosts validation by manipulating the X-Forwarded-Host header when the Host header is missing. This can lead to host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. These impacts affect the integrity of application behavior and security controls relying on host validation.

This vulnerability is fixed in Litestar version 2.22.0. Users should upgrade to version 2.22.0 or later to remediate the issue. Additionally, deploying a reverse proxy that strips or validates the X-Forwarded-Host header can mitigate the risk. Applications accepting HTTP/1.0 connections should also consider restricting or validating such traffic. Patch status is not explicitly confirmed in the advisory, but the fix is stated to be in version 2.22.0.