Update dependency starlette to v1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
starlette (changelog)	==0.52.1 → ==1.3.1

---

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

CVE-2026-48710 / GHSA-86qp-5c8j-p5mr

More information

Details

Summary

In affected versions, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed.

Details

When a client requests http://example.com/foo, it sends:

GET /foo HTTP/1.1
Host: example.com

Affected versions reconstructed the URL by concatenating http://{host}{path} and re-parsing the result. The Host value is only valid as a uri-host [ ":" port ] per RFC 9112 §3.2, where uri-host follows the restricted host grammar of RFC 3986 §3.2.2. When it contains characters outside that grammar - notably /, ?, or # - those characters move the path/query/fragment boundaries during re-parsing, so the parsed request.url.path no longer matches the path the server actually received. For example:

GET /foo HTTP/1.1
Host: example.com/abc?bar=

reconstructs to http://example.com/abc?bar=/foo, whose parsed path is /abc - even though routing used the real path /foo. The router still dispatches to /foo and the endpoint executes, but any middleware or code that reads request.url.path sees /abc, so path-based authorization checks can be bypassed.

Impact

Any application running an affected version that relies on request.url (or request.url.path) for security-sensitive decisions is affected. The most common case is middleware that gates access to certain path prefixes based on request.url.path. Deployments fronted by a proxy or load balancer are mitigated only if that proxy rejects or normalizes the malformed Host header before forwarding and the application does not trust attacker-controlled host headers (e.g. X-Forwarded-Host) elsewhere.

Mitigation

Upgrade to a patched version, which validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
• https://nvd.nist.gov/vuln/detail/CVE-2026-48710
• https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
• https://badhost.org
• https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
• https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
• https://www.secwest.net/starlette
• https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
• https://github.com/advisories/GHSA-86qp-5c8j-p5mr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Starlette: Arbitrary HTTP method dispatched to HTTPEndpoint attributes via getattr

CVE-2026-48817 / GHSA-x746-7m8f-x49c

More information

Details

Summary

When dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs.

When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler.

Details

HTTPEndpoint uses the client-supplied method name to resolve an instance attribute, without validating it against the set of HTTP verbs the endpoint supports. A method such as _DO_DELETE therefore resolves an attribute like _do_delete and invokes it. Non-standard methods are valid RFC 9110 token methods, so an endpoint must not treat the method name as a trusted attribute selector.

Impact

An application is affected when all of the following hold:

• It defines an HTTPEndpoint subclass and registers it via Route(...) without an explicit methods= argument.
• The subclass defines additional methods whose names match a non-standard HTTP-method token shape and that accept a single request argument and return a response.

This also affects frameworks built on Starlette, like FastAPI.

Mitigation

Register HTTPEndpoint subclasses with an explicit methods= argument on the Route, listing only the HTTP verbs the endpoint supports. The route then rejects any other method with 405 Method Not Allowed before it reaches the endpoint, so non-standard methods cannot resolve an attribute.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c
• https://github.com/advisories/GHSA-x746-7m8f-x49c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

CVE-2026-48818 / GHSA-wqp7-x3pw-xc5r

More information

Details

Summary

When serving static files on Windows, StaticFiles resolves the requested path with os.path.realpath. If a UNC path (such as \\attacker.com\share) reaches the resolver, realpath causes the process to open a connection to the remote host over SMB (port 445). This is a server-side request forgery (SSRF) that leaks the service account's NTLMv2 credentials to the attacker-controlled host, which can then be cracked offline or relayed to other hosts.

Details

StaticFiles.lookup_path() joins the requested path onto the served directory and calls os.path.realpath on the result before checking containment with os.path.commonpath. On Windows, a UNC path is absolute, so os.path.join discards the served directory and realpath resolves the bare UNC path, triggering the outbound SMB connection and NTLM authentication before the containment check rejects the path. The HTTP response is a benign 404, but the credential disclosure has already happened. POSIX systems are not affected.

This only affects the default configuration (follow_symlink=False), which uses os.path.realpath. The follow_symlink=True branch uses os.path.abspath, which performs no I/O.

Impact

Applications running on Windows that serve files with StaticFiles (directly, or via a framework built on Starlette such as FastAPI) in the default configuration are affected. StaticFiles is typically unauthenticated, so any client can trigger the SMB connection and leak the service account's NTLMv2 hash. A secondary impact is discovering internal hosts reachable over SMB by timing responses for valid versus invalid addresses.

Mitigation

Applications not running on Windows are not affected. On Windows, serving static files through a dedicated web server (such as nginx or IIS) instead of StaticFiles avoids the issue. Blocking outbound SMB (port 445) from the application host prevents the credential disclosure even if a UNC path is resolved.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r
• https://github.com/advisories/GHSA-wqp7-x3pw-xc5r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

CVE-2026-54282 / GHSA-jp82-jpqv-5vv3

More information

Details

Summary

In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host.

Details

When a client requests a path that does not start with /:

GET @​google.com HTTP/1.1
Host: localhost

affected versions reconstruct the URL as http://localhost@google.com. Per RFC 3986 §3.2.1, the substring before @ in the authority is userinfo, so re-parsing yields username = "localhost" and hostname = "google.com", with an empty path:

request.url          == "http://localhost@google.com"
request.url.hostname == "google.com"
request.url.path     == ""

The root cause is that the path is concatenated directly after the host without a separating /, and without validating that it begins with one. Only the Host header was validated when constructing request.url; the path was not.

This requires an ASGI server that forwards a request-target lacking a leading / into scope["path"].

Impact

Any application running an affected version that uses request.url, request.url.netloc, or request.url.hostname for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first.

Note that this is less exploitable than GHSA-86qp-5c8j-p5mr: there, the poison is carried in the Host header, so the real path still routes to a valid endpoint while request.url.path lies. Here, the poison must be carried in the path itself, and that path (@google.com) does not match any registered route, so routing returns 404 and no endpoint handler runs. The exposure is limited to code that reads request.url before routing - notably middleware - or in 404/exception handlers.

Mitigation

Upgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields http://localhost/@​google.com with request.url.hostname == "localhost".

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3
• https://github.com/advisories/GHSA-jp82-jpqv-5vv3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

CVE-2026-54283 / GHSA-82w8-qh3p-5jfq

More information

Details

Summary

request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.

Details

request.form() dispatches to a different parser depending on the Content-Type. For multipart/form-data the max_files, max_fields, and max_part_size limits are forwarded to the parser, but for application/x-www-form-urlencoded the parser is constructed without them. It has no max_fields or max_part_size parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.

Because the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:

• Field count drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as f0=v&f1=v&...) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.
• Field size drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the FormData, forcing memory allocation proportional to the request body.

The equivalent multipart/form-data request is correctly rejected with 400 Too many fields / 400 Field exceeded maximum size.

Impact

This Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call request.form() on application/x-www-form-urlencoded requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.

Mitigation

Upgrade to a patched version, which forwards max_fields and max_part_size to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match multipart/form-data (max_fields=1000, max_part_size=1MB) and can be customized via request.form(max_fields=..., max_part_size=...).

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq
• https://github.com/advisories/GHSA-82w8-qh3p-5jfq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

Kludex/starlette (starlette)

v1.3.1: Version 1.3.1

Compare Source

What's Changed

• Use StarletteDeprecationWarning instead of DeprecationWarning by @​Kludex in #​3119
• Enforce max_fields and max_part_size in FormParser by @​Kludex in #​3329
• Enforce FormParser limits in parser callbacks by @​Kludex in #​3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

v1.3.0: Version 1.3.0

Compare Source

What's Changed

• Clamp oversized suffix ranges in FileResponse by @​jiyujie2006 in #​3307
• Catch OSError alongside MultiPartException when closing temp files by @​N3XT3R1337 in #​3191
• Add httpx2 to the full extra by @​Kludex in #​3323
• Adjust testclient typing and warnings by @​waketzheng in #​3322
• Fix IndexError in URL.replace() on a URL with no authority by @​LeSingh1 in #​3317
• Annotate URLPath protocol parameter with Literal by @​Chang-LeHung in #​3285
• avoid collapsing exception groups from user code by @​graingert in #​2830
• Use removeprefix to strip weak ETag indicator in is_not_modified by @​gnosyslambda in #​3193
• Build request.url from structured components by @​Kludex in #​3326

New Contributors

• @​jiyujie2006 made their first contribution in #​3307
• @​N3XT3R1337 made their first contribution in #​3191
• @​leestana01 made their first contribution in #​3319
• @​LeSingh1 made their first contribution in #​3317
• @​EmmanuelNiyonshuti made their first contribution in #​3204
• @​Chang-LeHung made their first contribution in #​3285
• @​gnosyslambda made their first contribution in #​3193

Full Changelog: Kludex/starlette@1.2.1...1.3.0

v1.2.1: Version 1.2.1

Compare Source

What's Changed

• Use httpx2 for type checking in the testclient module by @​leifwar in #​3304
• Add assert error for requires() when request param is not Request type by @​KeeganOP in #​3298

New Contributors

• @​leifwar made their first contribution in #​3304
• @​diskeu made their first contribution in #​3243
• @​KeeganOP made their first contribution in #​3298

Full Changelog: Kludex/starlette@1.2.0...1.2.1

v1.2.0: Version 1.2.0

Compare Source

What's Changed

• Support httpx2 in the test client by @​Kludex in #​3291

Full Changelog: Kludex/starlette@1.1.0...1.2.0

v1.1.0: Version 1.1.0

Compare Source

What's Changed

• Use "application/octet-stream" as the FileResponse media type fallback by @​ATOM00blue in #​3283
• Only dispatch standard HTTP verbs in HTTPEndpoint by @​Kludex in #​3286
• Reject absolute paths in StaticFiles.lookup_path by @​Kludex in #​3287

New Contributors

• @​ATOM00blue made their first contribution in #​3283

Full Changelog: Kludex/starlette@1.0.1...1.1.0

v1.0.1: Version 1.0.1

Compare Source

What's Changed

• Ignore malformed Host header when constructing request.url by @​Kludex in #​3279

Full Changelog: Kludex/starlette@1.0.0...1.0.1

v1.0.0: Version 1.0.0

Compare Source

Starlette 1.0 is here! 🎉

After nearly eight years since its creation, Starlette has reached its first stable release.

A special thank you to @​lovelydinosaur, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏

Thank you to @​adriangb, @​graingert, @​agronholm, @​florimondmanca, @​aminalaee, @​tiangolo, @​alex-oleshkevich, @​abersheeran, and @​uSpike for helping make Starlette what it is today. And to all my sponsors - especially @​tiangolo, @​huggingface, and @​elevenlabs - thank you for your support!

Thank you to all 290+ contributors who have shaped Starlette over the years! ❤️

Read more on the blog post.

Check out the full release notes at https://www.starlette.io/release-notes/#​100-march-22-2026

---

Full Changelog: Kludex/starlette@1.0.0rc1...1.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.