Kludex Starlette HTTP Request/Response Smuggling (CVE-2026-48710)

Catalog analysis: CISA added this entry on September 02, 2026. The entry reflects catalog information retrieved on September 02, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-48710 is an HTTP request/response smuggling vulnerability (CWE-444) identified in Kludex Starlette. The flaw allows an attacker to inject paths into the host portion of an HTTP request, which then prepends the actual path. This mechanism can result in authentication bypass if the application’s authentication logic relies on the reconstructed URL path to determine access rights.

Our analysis indicates this vulnerability may be chained with CVE-2026-42271, potentially increasing the overall risk profile for affected deployments.

Exposure and applicability

This vulnerability affects systems utilizing the Kludex Starlette component. Because Starlette is an open-source library, exposure extends to any third-party products or proprietary implementations that integrate this specific component into their web stack.

Applicability depends on how the implementation handles URL reconstruction. Systems are most at risk if they use the reconstructed path for security-critical decisions, such as verifying whether a request is authorized to access a specific endpoint. Infrastructure owners should prioritize assets with direct internet exposure and those serving as gateways or proxies where request smuggling is more likely to occur.

Remediation priorities

Based on the available data, we recommend the following priority actions:

1. Identify Component Usage: Inventory all applications and third-party software utilizing Kludex Starlette to determine the scope of exposure.
2. Apply Vendor Mitigations: Implement the corrective actions specified in the vendor’s security advisories. For federal agencies, CISA has established a remediation deadline of September 16, 2026.
3. Review Authentication Logic: Evaluate whether authentication mechanisms depend on reconstructed URL paths, as this is the primary vector for the reported bypass.
4. Assess Chain Potential: Review environments for the presence of CVE-2026-42271 to determine if the risk of a chained attack is present.

How to validate remediation

Applying a patch or updating a library version is a necessary first step, but it does not alone prove that the vulnerability has been mitigated in a specific environment. To verify that exposure has actually been reduced, defenders should:

• Validate Path Reconstruction: Test how the application handles requests with manipulated host headers to ensure that injected paths are no longer prepended to the actual path.
• Verify Authentication Integrity: Confirm that authentication checks remain robust even when the reconstructed URL is altered, ensuring that the bypass mechanism is no longer functional.

Verification should focus on the result of the request processing rather than simply confirming a version number.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, because Starlette is integrated into various third-party products, the exact impact may vary depending on how those products wrap the library.

Residual risk persists if compensating controls (such as a Web Application Firewall) are used instead of direct patching, as WAF rules may not capture all variations of path injection. Defenders must determine if their specific implementation of Starlette is vulnerable by referencing the vendor’s detailed advisory.

Source and editorial note

CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability · Source date: September 02, 2026 · Retrieved September 02, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment