Host Header Injection in Litestar ASGI Framework by Litestar
CVE-2026-48061

5.9MEDIUM

Key Information:

Vendor

Litestar-org

Status
Litestar
Vendor
CVE Published:
3 August 2026

What is CVE-2026-48061?

The Litestar ASGI framework, versions prior to 2.22.0, is susceptible to a host header injection vulnerability. This vulnerability arises when the framework fails to validate the Host header properly, allowing an attacker to bypass restrictions by omitting the Host header and supplying a crafted X-Forwarded-Host header. This can lead to various attack vectors, including password reset poisoning, cache manipulation, and server-side request routing exploits. Applications utilizing AllowedHostsConfig are at risk, especially if deployed without a reverse proxy that removes the X-Forwarded-Host header, or when accepting HTTP/1.0 connections. This issue has been addressed in version 2.22.0.

Affected Version(s)

litestar < 2.22.0

References

https://github.com/litestar-org/litestar/security/advisor...
x_refsource_CONFIRM
https://github.com/litestar-org/litestar/commit/6930a20ce...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.