CVE-2026-54282 affects the Kludex starlette ASGI framework prior to version 1.3.0. The vulnerability arises because the HTTP request path is not validated before being used to reconstruct request.url by concatenating scheme, host, and path and then re-parsing. If the path does not begin with a slash (e.g., '@google.com'), the authority boundary shifts during re-parsing, allowing attacker control over request.url.hostname and request.url.netloc. This can cause downstream code that trusts request.url.hostname to be misled by attacker-supplied host information. The vulnerability is addressed in starlette version 1.3.0.

The vulnerability allows an attacker to control the hostname and netloc components of the reconstructed request URL by supplying a specially crafted path. This can mislead application logic that relies on request.url.hostname for security decisions, potentially causing incorrect trust assumptions. The CVSS score is 3.7 (low severity), indicating limited impact with no confidentiality or availability loss, but some integrity impact.

Upgrade starlette to version 1.3.0 or later, where this vulnerability is fixed by proper validation of the HTTP request path before reconstructing request.url. No other mitigation is indicated or required.