CVE-2026-48710 affects the Kludex Starlette ASGI framework versions before 1.0.1. The vulnerability arises because the HTTP Host header was not validated before being used to reconstruct request.url. Since routing relies on the raw HTTP path but security checks may rely on request.url, a malformed Host header can cause inconsistent interpretation of the request path, enabling bypass of security restrictions. Version 1.0.1 mitigates this by validating the Host header against RFC 9112 §3.2 and RFC 3986 §3.2.2 grammar and falling back to scope["server"] for malformed headers.

An attacker can craft HTTP requests with malformed Host headers that cause the reconstructed request.url.path to differ from the actual requested path. This discrepancy can allow bypass of middleware or endpoint security restrictions that rely on request.url, potentially leading to unauthorized access or privilege escalation. The CVSS score is 6.5 (medium severity), indicating limited confidentiality and integrity impact without availability impact. No known exploits are reported in the wild.

Users should upgrade to Starlette version 1.0.1 or later, where the Host header is properly validated and malformed values fallback to a safe default. No official patch link or advisory is provided, but upgrading to the fixed version is the recommended remediation. Since this is not a cloud service, users must apply the upgrade themselves. Patch status is not explicitly confirmed beyond the version fix; check vendor sources for updates.