Starlette: malformed Host header makes request.url.path diverge from the routed path

Impact

Starlette routed on the raw ASGI scope path but rebuilt request.url from the unvalidated HTTP Host header, so a malformed header could make request.url.path differ from the path actually served. Any middleware or endpoint that enforces access restrictions by inspecting request.url rather than scope can therefore be talked past, while routing still dispatches to the real handler. This matters on a GPU fleet because Starlette is the request layer under the FastAPI-based inference and gateway services operators run in front of accelerators - the record names Red Hat AI Inference Server 3.3 and Red Hat OpenShift AI 3.3 among affected products - and those deployments commonly bolt auth, tenant scoping, or admin/metrics-path blocking onto middleware. Whether a given service is actually bypassable depends on how its middleware is written; the record does not enumerate exploitable downstream configurations, so audit rather than assume. CISA lists this in the Known Exploited Vulnerabilities catalog.

Who can reach it

Anyone who can send an HTTP request to a Starlette or FastAPI service, including through a proxy that forwards the client-supplied Host header. No authentication needed. Reach is whatever can talk to the service: tenant pods for a cluster-internal endpoint, the internet for a published one.

What to do

Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112 3.2 / RFC 3986 3.2.2 and falls back to scope["server"] for malformed values, then restart the affected services. For vendor-packaged stacks such as Red Hat AI Inference Server and OpenShift AI, wait for the rebuilt images and roll the pods - the record does not give fixed versions for those products, so do not assume one. Rolling application pods, not draining or rebooting GPU nodes. As a compensating measure, have middleware make its decisions from the raw scope path, and reject unexpected Host values at the ingress.

References

Related entries

• vLLM - sampling parameter validation: Temperature validation uses strict comparison operators, so boundary values slipCVE-2026-54235 · vLLM - sampling parameter validationMedium
• MLflow: missing permission check on runs/log-inputs lets any user forge another run's lineageCVE-2026-69146 · MLflow tracking server auth plugin (mlflow/server/auth, runs/log-inputs endpoint)Medium
• vLLM: MiMo-V2-Omni processor bypasses media allowlists, enabling SSRF and local file readsCVE-2026-73560 · vLLM MiMoV2OmniMultiModalProcessor (media fetching in transformers_utils/processors/mimo_v2_omni.py)Medium
• Keras: malicious .keras/.h5 weights file reads arbitrary local files via HDF5 ExternalLinksCVE-2026-9335 · Keras (KerasFileEditor and keras.saving.load_weights HDF5 ExternalLink handling)Medium
• vLLM OpenAI-compatible server (chat_template / chat_template_kwargs): NOISY-NEIGHBOUR DENIAL OF SERVICE: one tenantNCVD-2025-018-vllm-openai-compatible-server-ch · vLLM OpenAI-compatible server (chat_template / chat_template_kwargs)Medium
• Ray (GCS Redis credential handling / logging): When the Redis password is passed on the Ray command line it getsCVE-2025-1979 · Ray (GCS Redis credential handling / logging)Medium