CVE-2026-48061 Details
Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that strips X-Forwarded-Host, or when accepting HTTP/1.0 connections. This issue has been fixed in version 2.22.0.
A vulnerability exists in Litestar versions prior to 2.22.0, where the AllowedHostsMiddleware can be bypassed by omitting the Host header and instead using the X-Forwarded-Host header with a whitelisted domain. This issue arises because the middleware trusts the X-Forwarded-Host header as a fallback when the Host header is missing. The vulnerability allows for host header injection attacks, including password reset link manipulation, cache poisoning, and server-side request routing changes. Applications using AllowedHostsConfig and deployed without a reverse proxy that removes X-Forwarded-Host, or those accepting HTTP/1.0 connections, are susceptible to this vulnerability.
Users can upgrade to Litestar version 2.22.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/litestar-org/litestar/security/advisories/GHSA-3qmc-cj7q-62hv | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/litestar-org/litestar/commit/6930a20ceb543912cd651b42deae5b9f3637a262 | [email protected] | Source CodeVendor |
| https://github.com/litestar-org/litestar/security/advisories/GHSA-3qmc-cj7q-62hv | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Litestar | <= 2.21.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |