Threats tagged 'brew-mcpm-cve-2026-48710'

A vulnerability in Starlette versions >=1.0.3 and <2.15.0 allows an attacker to bypass path-based security checks by sending a malformed HTTP Host header. This causes the reconstructed request.url.path to differ from the actual requested path, potentially bypassing middleware or endpoint security that relies on request.url.path. The vulnerability is mitigated by validating the Host header against RFC 9112 and RFC 3986 grammar or by using a reverse proxy that rejects malformed Host headers.