One slash in a Host header moves the path Starlette's middleware checks

Two path values travel inside one request. The router dispatches on `scope["path"]`, the raw request target, while any middleware calling `request.url.path` gets whatever Starlette's URL reconstruction produced ^[8]. Before 1.0.1 that reconstruction concatenated the client-supplied `Host` header with the request path and re-parsed the result as a URL, without validating the `Host` value against RFC 9112 or RFC 3986 ^[6]. A `Host` containing a slash, question mark, hash, at-sign, backslash or space therefore moves the path boundary in the re-parsed URL ^[7]. The classification is CWE-444, inconsistent interpretation of HTTP requests ^[2].

Exploitation is gated on three conditions: the application decides something security-relevant from `request.url` or `request.url.path`, usually a path-prefix allowlist or a public-path bypass list; no reverse proxy, CDN or API gateway in front of it already rejects or normalises malformed `Host` values; and the server is reachable with an attacker-controlled `Host` header ^[10]. Endpoints protected by FastAPI `Depends()` or `Security()`, or by permission checks in business logic, are not bypassed by path pollution alone, because those checks bind to the endpoint and not to a reconstructed URL ^[11]. A Starlette application that makes no security decision on `request.url.path` is not exploitable this way ^[20].

Testing your own service is cheap. X41 D-Sec demonstrated a `403 Forbidden` turning into `200 OK` after a single character was added to the `Host` header ^[12]. X41 also found multiple open-source projects whose security checks read the reconstructed URL, and warned the bypass can chain into server-side request forgery and, in some deployments, remote code execution ^[13].

The exposure figures attached to this CVE are counts of somebody else's fleet. A ZoomEye query for `http.body="Starlette"` returned 1,249 assets, a narrower query pairing the uvicorn server header with that body returned 437, and `title="Starlette"` returned 252 ^[21]. GitHub lists more than 400,000 projects depending on Starlette ^[19], so the largest of those scan results covers about 0.3 percent of the dependent population ^[22]. For any of the three numbers to say something about your estimate, your service would have to answer an unauthenticated scan with a page whose body carries the string "Starlette". A FastAPI service with custom error handlers and no exposed docs route matches none of the queries and can still authorise on `request.url.path`.

LiteLLM shows the chain with version numbers. Releases 1.74.2 through 1.83.6 ship the vulnerable MCP debug endpoints, 1.83.7 fixes the command injection but not the framework-level bypass, and 1.84.0 or later addresses both ^[18]. Horizon3.ai reported that CVE-2026-48710 removes the authentication requirement from CVE-2026-42271, the command injection in those MCP test endpoints ^[14], and that the chain reaches model provider credentials, proxy-stored API keys and connected AI infrastructure ^[15].

Which severity you inherit depends on which report matches your deployment. Starlette's maintainers published 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N ^[3]. X41 put practical risk at 7.0 and argued the base score understates impact in AI tooling deployments ^[4]. CISA's catalog entry cites evidence of active exploitation, and the published account does not identify the exploited deployments ^[5]. Versions 0.8.3 up to and including 1.0.0 are affected and 1.0.1 is the fix ^[16], which for once fits on one line of a lockfile. Teams that bump the pin still have to find every middleware path check reading `request.url.path` ^[8].