MEDIUMCVSS 6.5Actively exploited · CISA KEV since 2026-09-02Vulnerability
CVE-2026-48710
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Properties
- Vulnerability name
- Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- Epss score
- 0.07056
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2026-09-16
- Exploited euvd since
- 2026-09-02T00:00:00+00:00
- Date added
- 2026-09-02
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Ghsa updated
- 2026-06-04T13:15:22Z
- Euvd base score version
- 3.1
- Score
- 6.5
- Euvd vendor
- Kludex, encode
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 6.5
- Is ghsa only
- false
- Vendor project
- Kludex
- Content hash
- b4633fa22d6a3737f46da9c0501f5b5782af4307a0eebcccc81db6baf0ace774
- Published at
- 2026-05-26T22:16:44.020
- Euvd updated
- 2026-10-01T17:41:26+00:00
- Last modified
- 2026-10-01T18:17:18.153
- Euvd epss pct
- 7.06
Related Entities (18)
AFFECTS_PRODUCT (11)
HAS_WEAKNESS (2)
AFFECTS (1)
DESCRIBES (1)
INVOLVES (1)
MENTIONED_IN (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph