The Starlette and LiteLLM advisories describe a Host-header parsing mismatch that can undermine path-based authorization—not the classic request-smuggling flaw where servers disagree about HTTP request-body framing. Check the versions actually deployed, update affected packages, and verify that any proxy in front of LiteLLM rejects or normalizes malformed Host values before forwarding them.
What the ASGI request-smuggling advisories describe
In affected Starlette versions, the router dispatches using the request path in the ASGI scope, while request.url is reconstructed using the Host header and path. If a malformed Host value changes how that URL is parsed, middleware can see a different request.url.path from the path the router uses.
As an Amazon Associate I earn from qualifying purchases.
That difference matters when authorization or another security check trusts the reconstructed URL field. LiteLLM documented a related authentication bypass: its authentication layer derived the effective route from request.url.path, so a crafted Host could make the gate evaluate a different route from the one FastAPI dispatched.
Starlette’s advisory classifies its issue as CWE-444, a category whose name includes HTTP request/response smuggling. The documented trigger, however, is Host-header input affecting URL reconstruction and security checks. It does not establish a Content-Length versus Transfer-Encoding disagreement or other request-body framing desynchronization.
#1 Best Overall
Which versions are affected, and what fixes them?
| Component and advisory | Affected versions | Fixed version listed | What to check |
|---|---|---|---|
| Starlette, CVE-2026-48710 | 1.0.0 and earlier | 1.0.1 | Find the resolved Starlette dependency and review security checks that use request.url.path. |
| LiteLLM, CVE-2026-49468 | Before 1.84.0 | 1.84.0 | Check the deployed LiteLLM version and whether the upstream edge validates or normalizes Host values. |
| Starlette, CVE-2026-54282, a related issue | Before 1.3.0 | 1.3.0 | Review security-sensitive use of request.url.hostname or request.url.netloc, and whether the ASGI server forwards malformed request targets. |
For the Host-header issue, Starlette’s 1.0.1 release notes say it ignores malformed Host headers when constructing request.url. For deployments that need to address both listed Starlette issues, use a compatible release containing both fixes; the related path issue lists 1.3.0 as its fix. Check the resolved dependency in the deployed environment rather than inferring it from an application’s top-level version.
How to check whether a deployment is exposed
- Identify the resolved packages. Inspect the deployed environment’s dependency resolution or lock data for Starlette and LiteLLM. Compare each installed version with the affected ranges above.
- Trace the security decision. Review middleware and authentication code for access-control decisions based on
request.url.path. For the related request-target issue, also look for security-sensitive reads ofrequest.url.hostnameandrequest.url.netloc. - Verify the actual edge behavior. Determine whether the CDN, WAF, reverse proxy, or host-based load balancer rejects or normalizes malformed Host values before they reach the application. Confirm what is forwarded; merely having a proxy does not prove protection.
- Review forwarded-host trust separately. Establish how the stack handles forwarded-host headers and whether their values can be controlled by clients. Validating Host alone does not settle the trustworthiness of other proxy headers.
- Update the affected components. Upgrade Starlette and LiteLLM to the fixed versions listed in their advisories, or later compatible releases, as applicable to the deployment.
When an upstream proxy changes the risk
The LiteLLM advisory says upstream Host validation or normalization can block the described bypass. It names a CDN or WAF, a reverse proxy with an explicit server_name allowlist, and a host-based load balancer as possible controls. Restricting network access to the proxy listener may also be appropriate where applicable.
Rank #2
The same advisory says most deployments are not affected and that LiteLLM Cloud customers are not affected. Those qualifications do not establish that every self-managed deployment is vulnerable or protected: the relevant question is what Host value reaches the application and how LiteLLM’s authentication code uses the reconstructed route.
How the related malformed-path issue differs
CVE-2026-54282 concerns a request path without a leading slash, not the malformed Host-header mechanism above. Before Starlette 1.3.0, directly appending such a path after the host during URL reconstruction could produce a different parsed hostname. The advisory’s example is GET @google.com HTTP/1.1 with Host: localhost, which can be reparsed as http://[email protected] so that request.url.hostname appears to be google.com.
This case requires an ASGI server to pass such a request target into scope["path"]. The advisory says the malformed path typically fails routing, limiting the possible impact to code that reads request.url before routing or in 404 and exception handlers. It describes this issue as less exploitable than the Host-header issue.
Why this is not the usual HTTP framing desynchronization
Classic request smuggling often involves an intermediary and a backend disagreeing about where one HTTP request ends, for example because of conflicting Content-Length and Transfer-Encoding handling. The cited Starlette and LiteLLM advisories instead describe inconsistent interpretations of URL-related inputs inside the application stack.
Rank #4
The ASGI protocol assigns inbound chunked transfer decoding to protocol servers, which pass decoded content to the application. That server responsibility is a separate layer: it does not correct application authorization logic that trusts a reconstructed URL field.
Recommended Free Tools
What the severity scores do—and do not—say
The GitHub Advisory Database lists CVE-2026-48710 at 6.5/10 CVSS v3.1 and CVE-2026-49468 at 9.5/10 CVSS v4. These are the respective advisories’ severity scores; they are not estimates of how many deployments are affected or how often exploitation occurs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
