PT-2026-7136 · Litestar · Litestar

Sirdorblu · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-25479

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.20.0

Description Litestar’s allowed hosts validation can be bypassed because configured host patterns are converted into regular expressions without escaping regex metacharacters. Specifically, the . metacharacter retains its special meaning, allowing an attacker to supply a host that matches the regex but is not the intended literal hostname. This issue affects applications relying on the AllowedHosts middleware to prevent Host header attacks, potentially leading to security control bypasses. The vulnerable component is litestar.middleware.allowed hosts. The vulnerable parameter is the allowed hosts configuration.

Recommendations Update to Litestar version 2.20.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-185

Related Identifiers

CVE-2026-25479

GHSA-93PH-P7V4-HWH4

Affected Products

Litestar

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25479.json · Exploit
• https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace · Patch
• https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-93ph-p7v4-hwh4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25479 · Security Note
• https://github.com/litestar-org/litestar/releases/tag/v2.20.0 · Note
• https://github.com/litestar-org/litestar · Note
• https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 · Note
• https://twitter.com/CVEnew/status/2020959701115052278 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2020994144546541915 · Twitter Post
• https://twitter.com/_cvereports/status/2020953372103180366 · Twitter Post