Threats tagged 'brew-semgrep-cve-2026-48817'

Starlette's HTTPEndpoint dispatches HTTP methods by lowercasing the method name and using getattr to call an attribute, without restricting to known HTTP verbs. If a route is registered without an explicit methods= argument, any HTTP method is accepted, allowing non-standard methods to invoke internal endpoint methods unintentionally. This can lead to unauthorized invocation of internal helper methods. The issue affects Starlette versions from 1.137.0 up to but not including 1.165.0 and frameworks built on it like FastAPI. A fix is available in version 1.165.0.