Starlette versions before 1.0.1 do not validate the HTTP Host header before using it to reconstruct request.url. Because routing relies on the raw HTTP path but request.url is rebuilt from the Host header, a malformed Host header can cause request.url.path to differ from the actual requested path (scope["path"]). Applications that enforce security restrictions based on request.url.path rather than the canonical ASGI path may be bypassed. The vulnerability does not directly grant access or modify routing but can lead to path-based authentication or authorization bypass if the application depends on request.url.path for security decisions. The issue is mitigated in Starlette 1.0.1 by validating the Host header against RFC 9112 §3.2 and RFC 3986 §3.2.2 grammar and falling back to scope["server"] for malformed values. Red Hat advisories note that in their products the impact is low due to deployment architectures and authentication methods used. A recommended mitigation is to use an RFC-compliant reverse proxy to reject malformed Host headers before they reach the application or update custom middleware to use scope["path"] for security decisions.

The vulnerability can cause a discrepancy between the reconstructed request.url.path and the actual requested path, potentially allowing bypass of security restrictions that rely on request.url.path. However, the vulnerability itself does not directly grant unauthorized access or modify routing. The impact depends heavily on downstream application design and whether security decisions are based on request.url.path instead of the canonical ASGI path. Red Hat rates the impact as low to moderate in their products due to existing mitigations such as reverse proxies and authentication mechanisms that do not rely on path-based middleware.

A fix is available by upgrading to Starlette version 1.0.1 or later, which validates the Host header properly. Alternatively, deploying an RFC-compliant reverse proxy (e.g., nginx, Apache, HAProxy, Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. Custom middleware should be updated to use request.scope["path"] instead of request.url.path for security decisions, as the ASGI scope path is derived from the HTTP request line and not influenced by the Host header. These mitigations effectively prevent exploitation without requiring code changes in many cases.