CVE-2026-25479: Litestar AllowedHosts Validation Bypass Vulnerability
Summary
CVE-2026-25479: AllowedHosts host validation can be bypassed because configured host patterns are turned into regular expressions without escaping regex metacharacters (notably .). Affects litestar versions >= 2.19.0, < 2.20.0. Fixed in 2.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Litestar is a Python web framework designed for building APIs and web applications. It offers features such as routing, middleware support, and asynchronous capabilities, making it suitable for modern web development. However, it has a vulnerability in its AllowedHosts middleware, which is intended to prevent Host header attacks by validating incoming requests against a configured allowlist of hostnames.
Vulnerability Detail
The vulnerability arises from the way Litestar compiles configured host patterns into regular expressions without properly escaping regex metacharacters. This oversight allows an attacker to bypass the intended hostname validation. For example, a configured allowlist entry like 'example.com' can match 'exampleXcom', leading to potential security risks such as cache poisoning and unauthorized access. The vulnerability is classified as a security control bypass, impacting applications that rely on AllowedHosts for protection against various attacks.
How To Fix
Minimum fixed version
2.20.0
This is the first release that contains the fix.
pip install --upgrade "litestar==2.20.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the Host header in your application logic before processing requests. Here is an example of how to implement this in your code:
from litestar import Litestar, get
@get("/")
async def index() -> str:
return "ok"
allowed_hosts = ["example.com"]
def validate_host(host_header: str) -> bool:
return host_header in allowed_hosts
@app.middleware("http")
def host_validation_middleware(request, call_next):
host_header = request.headers.get("Host")
if not validate_host(host_header):
return Response(status_code=400, content="Invalid host")
return await call_next(request)
app = Litestar([index])
Conclusion
The Litestar AllowedHosts validation bypass vulnerability (CVE-2026-25479) poses a significant risk to applications relying on hostname validation. It is crucial to update to the latest version of Litestar to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for litestar →
FAQ
The vulnerability allows attackers to bypass hostname validation, potentially leading to various attacks such as cache poisoning and unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of Litestar prior to 2.20.0 are affected by this vulnerability. It is recommended to upgrade to version 2.20.0 or later.
If an immediate upgrade is not possible, implement a manual host validation as a temporary workaround to mitigate the risk.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for litestar.
