Last Updated: 2026-05-26T20:52:48Z
What’s Happening
A single character injected into the HTTP Host header bypasses path-based authorization in Starlette, the routing core of FastAPI.
X41 has published a scanner, Semgrep rules, and CodeQL queries at Github.com/x41sec/poc/tree/master/starlette-host-header
Actions
There are mitigation and upgrades available, and some design considerations to use a reverse proxy that rejects malformed Host Headers ahead of the ASGI-served applications. Details at the advisory.
A scanner has been released to determine if a given internet-facing server is vulnerable.
Notes
Ars Technica picked up the story.