CVE-2026-25479mediumCWE-185

CVE-2026-25479: fallo de gravedad media en litestar-org litestar

Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear litestar+ Monitorear litestar

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Productos afectados
litestar-org · litestar
CVEs relacionadas — litestar-org litestar

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-52581HIGHLitestar allows unbounded resource consumption (DoS vulnerability)EPSS 0.8%CVE-2024-32982HIGHLitestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')EPSS 0.7%CVE-2024-42370HIGHLitestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflowEPSS 0.7%CVE-2025-59152HIGHX-Forwarded-For Header Spoofing Bypasses Litestar Rate LimitingEPSS 0.5%CVE-2026-25480MEDIUMFileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)EPSS 0.5%CVE-2026-25478HIGHLitestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed originsEPSS 0.4%