Litestar is an ASGI framework that validates incoming hosts with its AllowedHostsMiddleware to prevent host header injection. In versions older than 2.22.0 the middleware falls back to the client‑controlled X‑Forwarded‑Host header when the standard Host header is missing or empty, allowing an attacker to supply a forged host value. This bypass can be used for password reset poisoning, cache poisoning and malicious routing of server‑side requests, compromising the integrity of the application and potentially exposing sensitive user data.

All deployments of the litestar-org litestar framework that use AllowedHostsConfig and run a version older than 2.22.0 are affected. The issue appears in every release prior to the patch, regardless of platform, as long as the framework is configured to trust the X‑Forwarded‑Host header when no Host header is present.

The CVSS score of 5.9 indicates moderate severity. Because the EPSS score is not available, the exact likelihood of exploitation is uncertain, but the vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to send a request without a Host header while including a malicious X‑Forwarded‑Host header, a scenario that is feasible against public HTTP/1.0 endpoints or misconfigured reverse proxies that forward this header. Should an attacker succeed, they can manipulate application flow or poison caches, potentially enabling credential theft or data disclosure.