litestar-org vulnerabilities and threats

Litestar versions prior to 2.22.0 contain a vulnerability in the AllowedHostsMiddleware where the X-Forwarded-Host header is trusted as a fallback when the Host header is missing. This allows an attacker to bypass allowed hosts validation by omitting the Host header and supplying a malicious X-Forwarded-Host header. The vulnerability enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. The issue is fixed in version 2.22.0.

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.

CVE-2026-25480 is a medium severity vulnerability in the litestar ASGI framework versions prior to 2.20.0. It arises from improper handling of Unicode normalization in the FileStore cache backend, which maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators. This flawed approach can cause cache key collisions when an unauthenticated remote attacker crafts specific URL paths, leading to cache poisoning or response mixups where one URL serves cached responses intended for another. The vulnerability does not require authentication or user interaction and impacts confidentiality and integrity by exposing or mixing cached data. It is fixed in litestar version 2.20.0. European organizations using vulnerable litestar versions as part of their web infrastructure may face risks of data leakage or incorrect content delivery.

CVE-2026-25479 is a medium-severity vulnerability in the litestar ASGI framework versions prior to 2.20.0. It arises from improper handling of allowlist host entries, where regex metacharacters are not escaped, allowing attackers to bypass intended hostname restrictions by supplying crafted host headers that match the regex but are not legitimate hosts. This can lead to partial confidentiality and integrity impacts without requiring authentication or user interaction. The vulnerability is fixed in litestar version 2.20.0. European organizations using vulnerable litestar versions in web applications may face risks of host header attacks, potentially enabling unauthorized access or manipulation of application behavior. Mitigation involves upgrading to version 2.

CVE-2026-25478 is a high-severity vulnerability in the litestar ASGI framework versions prior to 2.20.0. It arises from improper construction of the allowed_origins_regex used for CORS origin validation, where metacharacters in the allowlist are not escaped. This flaw allows malicious origins to bypass the intended restrictions, potentially enabling cross-domain attacks. Exploitation requires user interaction but no authentication, and it can lead to a breach of confidentiality by exposing sensitive data to untrusted domains. The vulnerability affects web applications using litestar for asynchronous server gateway interfaces, particularly those relying on CORS for security. Although no known exploits are currently in the wild, the vulnerability's nature and CVSS score of 7.4 indicate a significant risk. European organizations using litestar in web services should prioritize upgrading to version 2.

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses `cache_key_from_request()` to generate cache keys for rate limiting. When an X-Forwarded-For header is present, the middleware trusts it unconditionally and uses its value as part of the client identifier. Since clients can set arbitrary X-Forwarded-For values, each different spoofed IP creates a separate rate limit bucket. An attacker can rotate through different header values to avoid hitting any single bucket's limit. This affects any Litestar application using RateLimitMiddleware with default settings, which likely includes most applications that implement rate limiting. Version 2.18.0 contains a patch for the vulnerability.