Starlette's Host-header trick is due today. FastAPI version is the wrong number.

CISA's clock on CVE-2026-48710 runs out today, September 16. The bug is in Starlette, the Python ASGI toolkit that sits under a lot of FastAPI services. Catalog language calls it request smuggling. The researchers who found it describe something more ordinary and more dangerous: your middleware thinks the request went to one path, and the router sent it to another.

How a Host header lies about the path

In Starlette 1.0.0 and earlier, the framework rebuilt request.url from the scheme, the Host header, and the path. It did not check whether Host was a legal host. A value with a slash or a question mark gets parsed as part of the URL path when that string is put back together.

Routing still uses the real path the server received. Security code often does not. It reads request.url.path. Those two values can disagree. Middleware that allows /public and blocks /admin can be talked into seeing the public path while the handler for the admin path still runs.

That is why a "medium" CVSS of 6.5 still landed on KEV. The impact depends on how you wrote the gate. Plenty of internal tools and AI wrappers do exactly this: check a prefix on request.url.path and trust it.

FastAPI version is the wrong number

FastAPI vendors Starlette as a dependency. Pinning FastAPI and forgetting Starlette is how shops stay vulnerable after they "updated the app." Affected Starlette trains run from 0.8.3 through 1.0.0. The fix is 1.0.1 and later. Run pip show starlette or read the lockfile. Do not stop at the FastAPI line in requirements.txt.

CISA added the CVE on September 2 after evidence of in-the-wild use. Today's due date is the federal one. Civilian teams should treat an internet-facing FastAPI that still shows Starlette 1.0.0 as overdue, not as a backlog item.

What we would do before the next deploy

• Inventory Python services that import Starlette or FastAPI, including internal admin panels and tool-execution APIs.
• Upgrade Starlette to 1.0.1 or newer and redeploy. Confirm the running container, not only the repo.
• Hunt access logs since early September for Host headers that contain /, ?, or #.
• Change middleware that authorizes on request.url.path to use the raw ASGI scope["path"], the same value routing uses.
• At the reverse proxy, reject malformed Host values. Do not forward junk just because the app "handles it."

Bottom line

Frameworks lie when they rebuild URLs from headers you do not validate. Forensic Five reviews internet-facing applications for Canadian organizations and writes down what was actually reachable. From St. Albert, Alberta. Check the lockfile.