Unrestricted HTTP Method Handling in Starlette Framework by Kludex

CVE-2026-48817

What is CVE-2026-48817?

In the Starlette framework versions 1.0.1 and earlier, an improper handling of HTTP methods in HTTPEndpoint allows an attacker to exploit the routing mechanism. When a request is dispatched, HTTPEndpoint accepts any method that matches defined attributes, without restrictions on the types of HTTP verbs. Consequently, if an HTTPEndpoint subclass is registered without explicitly specifying the permitted methods, unauthorized low-level functions could be executed as handlers. This oversight facilitates access to internal methods that lack proper authorization checks, posing significant security risks to applications built on Starlette or similar frameworks like FastAPI. The issue has been addressed in version 1.1.0.

References