BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass • Hacker News Board

nickcw wrote: post #7

If you read the advisory and are wondering what starlette is, from it's web page: starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It's used a lot in the data heavy AI world for it's efficiency shipping large files. This includes lots and lots of production servers. From the advisory: this includes LLM inference servers like vLLM, LLM proxy servers like Lite…

Ironically typing ‘make sure my server is secure’ into an LLM either wasn’t done, or missed it until now.

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#15

Post by anakaine » Wed, May 27, 2026, 9:05 AM UTC

noirscape wrote: post #10

If you're using nginx/apache/literally anything that does reverse proxying correctly, this shouldn't be a problem unless you're routing all traffic over default_server rules unstead of server_name (or the equivalent). They should be stopping this attack at the door (even if only to clean out your logs from scraper door knocks), which is probably why it went unnoticed for years. I don't think anyone would be deploying…

Ars has had a depreciating quality the past few years by most accounts. They've been trying a bit harder recently it seems, but shaking off the allure of half baked short form journalism is hard, I guess.

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#16

Post by 0123456789ABCDE » Wed, May 27, 2026, 9:05 AM UTC

andrewstuart wrote: post #9

Setting aside this issue, Starlette is a really great web server. If you do async python I strongly recommend it. FastAPI is built on Starlette - to be honest I don’t see the point of the extra baggage - just use Starlette.

fastAPI will give you `/openapi.json`, `/docs` with no extra effort

function name becomes a human readable summary, string docs the description

edit: bottle.py and fastapi are the most significant contributions to web frameworks in python — decorators for path handlers, typed input/output, automatic docs

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#17

Post by burner420042 » Wed, May 27, 2026, 9:23 AM UTC

Notably CVE-2026-48710 hasn't been added into cloud sec vuln catalogs quite yet. Since fastapi ~is starlette, expect the later half of this week / early next to be busy.

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#18

Post by Ozzie-D » Wed, May 27, 2026, 9:25 AM UTC

[flagged]

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#19

Post by Muromec » Wed, May 27, 2026, 9:31 AM UTC

s2l wrote: post #6

From the link, on how the attack works: An attacker can send a crafted request like GET /protected with a Host: example.com/health?x= header. The request will reach the /proteced path, but request.url would be https://example.com/health?x=/protected , and request.url.path would return /health instead of the real request path.

So the classic case of two parsers disagreing and being too permissive in accepting input

Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass

#20

Post by Muromec » Wed, May 27, 2026, 9:33 AM UTC

0123456789ABCDE wrote: post #16

andrewstuart wrote: post #9

Setting aside this issue, Starlette is a really great web server. If you do async python I strongly recommend it. FastAPI is built on Starlette - to be honest I don’t see the point of the extra baggage - just use Starlette.

fastAPI will give you `/openapi.json`, `/docs` with no extra effort function name becomes a human readable summary, string docs the description edit: bottle.py and fastapi are the most significant contributions to web frameworks in python — decorators for path handlers, typed input/output, automatic docs

Is it like flask, but even flaskier?