The vulnerability in Litestar arises from how its FileStore component creates cache keys. It normalizes request paths using Unicode NFKD and substitutes character code points via ord() without separating delimiters, which can produce identical keys for different URLs. An attacker who can send arbitrary HTTP requests to the server can craft paths that collide with legitimate cache keys, resulting in one URL serving the cached response of another. The effect is that sensitive data may be disclosed or the application may provide incorrect content, meeting CWE-176. The impact is not complete control over the system but can lead to information disclosure and functional disruption.

Litestar, an ASGI framework produced and maintained by litestar-org, is vulnerable in all releases prior to version 2.20.0. The problem is specific to deployments that use the FileStore as a response‑cache backend; if that feature is not enabled, the risk is mitigated.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1 %, implying a very low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, an unauthenticated attacker can reach the server over HTTP and send a crafted path to trigger the collision. The attack requires no special privileges, depends on the presence of the FileStore response‑cache backend, and leads directly to cache poisoning. While the likelihood of exploitation is low, the potential information disclosure is significant enough to warrant patching.