CVE-2026-25480 Details

A vulnerability in Litestar's FileStore response caching mechanism prior to version 2.20.0 can lead to cache key collisions and subsequent cache poisoning. FileStore normalizes cache keys using Unicode NFKD normalization and ordinal substitution without separators, creating collisions that an unauthenticated remote attacker can exploit. This vulnerability arises because the default cache key includes the request path and sorted query parameters, both of which can be controlled by the attacker. As a result, one URL can serve cached responses intended for another, potentially causing confidentiality and integrity issues depending on the cached endpoints.

Users can update to Litestar version 2.20.0 or later, where this vulnerability has been fixed.