CVE-2026-48710 describes an inconsistent interpretation of HTTP requests in the Kludex Starlette ASGI framework prior to version 1.0.1. The vulnerability arises because the HTTP Host header was not validated before being used to reconstruct request.url. Since routing relies on the raw HTTP path but security checks may rely on request.url.path, a malformed Host header can cause these to differ, enabling bypass of security restrictions that depend on request.url. The issue is addressed in version 1.0.1 by validating the Host header against RFC 9112 §3.2 and RFC 3986 §3.2.2 grammar and falling back to scope["server"] for malformed values.

This vulnerability allows attackers to craft HTTP requests with malformed Host headers that cause the reconstructed request.url.path to differ from the actual requested path. Middleware or endpoints that enforce security policies based on request.url rather than the raw HTTP path may be bypassed, potentially leading to unauthorized access or privilege escalation. The CVSS score is 6.5 (medium severity), indicating a moderate impact on confidentiality and integrity without affecting availability.

Users should upgrade to Starlette version 1.0.1 or later, where the Host header is properly validated and malformed values fallback to a safe server scope. No other mitigation is indicated by the vendor advisory. Patch status is not explicitly stated in the vendor advisory, but upgrading to >=1.0.1 is the recommended fix.