Starlette versions before 1.0.1 do not validate the HTTP Host header before using it to reconstruct request.url. Because routing uses the raw HTTP path but request.url is rebuilt from the Host header, a malformed Host header can cause request.url.path to differ from the actual requested path (scope["path"]). Applications that enforce security based on request.url.path rather than the canonical ASGI path can be bypassed. The vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests) and CWE-1289 (Improper Validation of Unsafe Equivalence in Input). The issue is mitigated in starlette 1.0.1 by validating the Host header against RFC 9112 and RFC 3986 grammar and falling back to scope["server"] for malformed values. Red Hat advisories confirm the moderate impact depends heavily on downstream application design and note that many deployments reduce impact by using reverse proxies or alternative authentication methods.

The vulnerability can cause a mismatch between the reconstructed request.url.path and the actual HTTP request path, potentially allowing bypass of path-based security restrictions if applications rely on request.url.path for access control. However, the vulnerability does not itself grant unauthorized access or modify routing. The impact is context-dependent and relies on application design choices. Red Hat rates the impact as moderate, with many real-world deployments reducing risk through reverse proxies or non-path-based authentication mechanisms.

A fix is available by upgrading to starlette version 1.0.1 or later, which properly validates the Host header. In the absence of an immediate upgrade, deploying an RFC-compliant reverse proxy (e.g., nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. Additionally, custom middleware should be updated to use the ASGI scope path (request.scope["path"]) instead of request.url.path for security decisions, as the scope path is not influenced by the Host header.