Threats tagged 'brew-semgrep-cve-2026-54282'

A vulnerability in Starlette versions 1.137.0 through 1.165.9 allows an attacker to manipulate the reconstructed request URL's hostname by supplying a request path that does not start with a slash. This causes the path to be interpreted as part of the URL authority, misleading code that relies on request.url.hostname for security decisions. The issue primarily affects middleware or handlers that inspect request.url before routing, with limited exploitability due to routing returning 404 for such paths.