Threats tagged 'brew-mcp-atlassian-cve-2026-54282'

Starlette versions from 0.11.9 up to but not including 0.21.1_8 have a vulnerability where the HTTP request path is not validated before reconstructing request.url. This allows a specially crafted path not starting with '/' to poison the URL authority, causing request.url.hostname to be attacker-controlled. This can mislead code relying on request.url.hostname for security decisions. The issue mainly affects middleware or 404/exception handlers that read request.url before routing. A patched version 0.21.1_8 is available that prevents this behavior.