Litestar allows unsafe regex compilation of host allowlist entries, letting malicious regex metacharacters interpret intended literal hostnames as pattern matches. An attacker can supply a Host header that matches the compiled regex but is not the desired hostname, bypassing the framework’s trust boundary. This permits the attacker to send requests with arbitrary host values that the application will treat as legitimate, potentially enabling host header injection, request forgery, or traffic spoofing within the application’s routing logic.

The vulnerability is present in all releases of the Litestar framework before version 2.20.0. Systems running Litestar 2.19.x or earlier are affected; the fix was delivered in release 2.20.0.

The CVSS score of 6.5 indicates a moderate severity. The EPSS probability is defined as less than 1 %, showing that exploitation is expected to be rare. This issue is not listed in the CISA KEV catalog. Exploitation requires only the ability to send HTTP requests with a crafted Host header, so the attack vector is network‑based and does not need authenticated access. Once the host header bypass is achieved, the attacker may target request handling procedures that rely on the Host value. Given the moderate severity and low EPSS, the overall risk is moderate but warrants prompt patching because the ability to forge host values can lead to unforeseen application behavior or escalation of other vulnerabilities.