Saint BadHost, Who Lied About His Own Address

Patron of ASGI frameworks, Host headers taken at face value, and middleware that protects the wrong path.

Life

On 22 May 2026 BadHost (CVE-2026-48710) went public: X41 D-Sec had found it during an OSTIF-funded audit of Starlette, the framework behind FastAPI and many AI services. Before version 1.0.1 the Host header was not validated before request.url was rebuilt: so the path seen by security middleware could differ from the one actually served, and URL-based checks were bypassed. CISA later added it to its known-exploited list.

Prayer

O Saint BadHost, who comes with an address that is not yours, let our middleware look at the true path. Amen.

How to celebrate

Celebrated by updating Starlette to 1.0.1 and basing checks on the raw path, not the rebuilt URL.

Trust the Host, and you serve the wrong door.

Technical record

Disclosed on: May 22 2026
CVE: CVE-2026-48710
CVSS: 6.5Actively exploited (CISA KEV)
Product: Kludex · starlette

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Sources: badhost.org · secwest.net · github.com · x41-dsec.de

Canonized during the vacant see

Saint BadHost, Who Lied About His Own Address

Life

Prayer

How to celebrate

Technical record

Related saints

Sharing the feast day

Same year: 2026