Summary
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
- Vendor
- Kludex
- Product
- Starlette
- Added to KEV
- Sep 2, 2026
- Remediation due
- Sep 16, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-444
- EPSS
- 70.3% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References