Starlette, a lightweight ASGI framework, had an omission where the HTTP Host header was used without validation to rebuild request.url. Because the routing logic depends on request.url.path, a crafted Host header could make that path differ from the actual HTTP path, allowing middleware or endpoints that enforce security based on request.url to be bypassed. This leads to a breach of intended access controls without requiring code execution or elevated privileges.

The vulnerability affects the Kludex starlette framework in all versions prior to 1.0.1. Users running those older releases are susceptible because the framework does not validate the Host header against RFC 9112 or RFC 3986 before reconstructing the URL.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of below 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through any network channel that can manipulate the Host header to convey a malicious request. Exploitation requires the ability to send crafted HTTP requests to an application using an affected Starlette version; no additional foothold is required beyond the ability to affect the HTTP traffic in transit or at the server.