CVE-2026-48710: Kludex Starlette
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
- Vendor
- Kludex
- Product
- Starlette
- Vulnerability
- Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Date added
- Sep 2, 2026
- CISA due date (U.S. federal agencies)
- Sep 16, 2026
- Known ransomware campaign use
- Unknown
- Weakness (CWE)
- CWE-444
References
This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.
Last updated: · Catalog version 2026.10.02