Regex Bypass Vulnerability in Litestar ASGI Framework by Litestar
CVE-2026-25479

6.5MEDIUM

Key Information:

Vendor

Litestar-org

Status
Litestar
Vendor
CVE Published:
9 February 2026

What is CVE-2026-25479?

The Litestar ASGI framework contains a vulnerability in the litestar.middleware.allowed_hosts functionality. Prior to version 2.20.0, allowlist entries were incorrectly handled, allowing regex patterns to improperly match unintended hostnames. This flaw enables attackers to exploit regex metacharacters, making it possible for them to pose as legitimate sources by supplying hostnames that match the regex but do not correspond to the actual intended host. This vulnerability has been addressed in version 2.20.0.

Affected Version(s)

litestar < 2.20.0

References

https://github.com/litestar-org/litestar/security/advisor...
x_refsource_CONFIRM
https://github.com/litestar-org/litestar/commit/06b36f481...
x_refsource_MISC
https://docs.litestar.dev/2/release-notes/changelog.html#...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.