Starlette: malformed Host header makes request.url.path diverge from the routed path

Impact

Starlette routed on the raw ASGI scope path but rebuilt request.url from the unvalidated HTTP Host header, so a malformed header could make request.url.path differ from the path actually served. Any middleware or endpoint that enforces access restrictions by inspecting request.url rather than scope can therefore be talked past, while routing still dispatches to the real handler. This matters on a GPU fleet because Starlette is the request layer under the FastAPI-based inference and gateway services operators run in front of accelerators - the record names Red Hat AI Inference Server 3.3 and Red Hat OpenShift AI 3.3 among affected products - and those deployments commonly bolt auth, tenant scoping, or admin/metrics-path blocking onto middleware. Whether a given service is actually bypassable depends on how its middleware is written; the record does not enumerate exploitable downstream configurations, so audit rather than assume. CISA lists this in the Known Exploited Vulnerabilities catalog.

Who can reach it

Anyone who can send an HTTP request to a Starlette or FastAPI service, including through a proxy that forwards the client-supplied Host header. No authentication needed. Reach is whatever can talk to the service: tenant pods for a cluster-internal endpoint, the internet for a published one.

What to do

Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112 3.2 / RFC 3986 3.2.2 and falls back to scope["server"] for malformed values, then restart the affected services. For vendor-packaged stacks such as Red Hat AI Inference Server and OpenShift AI, wait for the rebuilt images and roll the pods - the record does not give fixed versions for those products, so do not assume one. Rolling application pods, not draining or rebooting GPU nodes. As a compensating measure, have middleware make its decisions from the raw scope path, and reject unexpected Host values at the ingress.

References

Related entries

• vLLM - sampling parameter validation: Temperature validation uses strict comparison operators, so boundary values slipCVE-2026-54235 · vLLM - sampling parameter validationMedium
• vLLM: audio input in chat completions skips the decode-duration limit, letting a small clip OOM the workerCVE-2026-57173 · vLLM (input_audio path in /v1/chat/completions, AudioMediaIO decode duration guard)Medium
• MLflow: missing permission check on runs/log-inputs lets any user forge another run's lineageCVE-2026-69146 · MLflow tracking server auth plugin (mlflow/server/auth, runs/log-inputs endpoint)Medium
• vLLM: request-selected video decoder backend allocates GPU memory outside the KV-cache budgetCVE-2026-69147 · vLLM (MediaConnector video backend selection / GPU memory budgeting)Medium
• vLLM: unbounded prompt array in /v1/completions lets one request exhaust the engineCVE-2026-73559 · vLLM OpenAI-compatible server (/v1/completions prompt list)Medium
• vLLM: MiMo-V2-Omni processor bypasses media allowlists, enabling SSRF and local file readsCVE-2026-73560 · vLLM MiMoV2OmniMultiModalProcessor (media fetching in transformers_utils/processors/mimo_v2_omni.py)Medium