Is catchy name with domain and website for every vulnerability now the norm? I mean it's good that it was found but there have been a lot of vulnerability websites lately.
BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
51–60 of 65 posts
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#52Is catchy name with domain and website for every vulnerability now the norm? I mean it's good that it was found but there have been a lot of vulnerability websites lately.
It's a bit of an overkill but then again, why not.
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#53[dead]
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#54Is catchy name with domain and website for every vulnerability now the norm? I mean it's good that it was found but there have been a lot of vulnerability websites lately.
they should make a .cve tld to make keeping track of these easier.
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#55Earlier quoted context omitted.
Is this still true?
You may be thinking of Litestar (previously named Starlite) that was based on Starlette akin to FastAPI but then went their own direction implementing a framework rather than relying on an upstream for their core product.
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#56Is catchy name with domain and website for every vulnerability now the norm? I mean it's good that it was found but there have been a lot of vulnerability websites lately.
they should make a .cve tld to make keeping track of these easier.
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#57Earlier quoted context omitted.
You may be thinking of Litestar (previously named Starlite) that was based on Starlette akin to FastAPI but then went their own direction implementing a framework rather than relying on an upstream for their core product.
https://github.com/fastapi/fastapi/blob/master/pyproject.tom...
..And?
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#58Never, ever, ever transform URIs and paths by string manipulation. If you think pulling in a library for this is overkill, it is not. (Lesson learned from trying to quickly write my own function to make ".." to go back one URL segment that took 3 hours and discovering the URI spec contradicts my intuition depending on whether the URI is a URL or filesystem path.)
You kind of have to, it's not turtles all the way down, at some point the network is sending strings my man.
You just have not to make mistakes, there's no silver bullet or instant cop-out like "this would never happen to me because I don't do one of the things in this multi-sub-system vuln".
Re: BadHost – CVE-2026-48710: Starlette Host-Header Auth Bypass
#59Earlier quoted context omitted.
Ironically typing ‘make sure my server is secure’ into an LLM either wasn’t done, or missed it until now.
The posted page has an entire section titled "Why didn't Mythos find this?" tl;dr: the bug spans three components in different code bases that when looked at in isolation each do reasonable things. The bug is in the interaction, in the assumed properties of the value that eventually gets exposed as request.url.path. That was apparently too subtle for current Anthropic models to spot
The posted page said that finding logic bugs of this kind requires ‘understanding’ which LLM cannot.