PT-2026-7137 · Litestar · Litestar

Sirdorblu · Published 2026-02-09 · Updated 2026-02-10 · CVE-2026-25480

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.20.0

Description Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. When the FileStore is used as a response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths. This results in one URL serving cached responses of another, leading to cache poisoning or mixup. The issue arises because FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. Specifically, characters like "-" and "k-" can normalize to "k45", and the Kelvin sign "K" can normalize to "K", causing collisions. The default cache key includes request path and sorted query parameters, which are attacker-controlled.

Recommendations Versions prior to 2.20.0 should be updated to version 2.20.0 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-176

CWE-20

Related Identifiers

CVE-2026-25480

GHSA-VXQX-RH46-Q2PG

Affected Products

Litestar

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25480.json · Exploit
• https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca · Patch
• https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxqx-rh46-q2pg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25480 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25480 · Vendor Advisory
• https://github.com/litestar-org/litestar/releases/tag/v2.20.0 · Note
• https://github.com/litestar-org/litestar · Note
• https://twitter.com/VulmonFeeds/status/2020991584590852603 · Twitter Post
• https://twitter.com/CVEnew/status/2020959700167090379 · Twitter Post
• https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 · Note
• https://reddit.com/r/VulnMatter/comments/1r1174e/resumen_diario_de_vulnerabilidades_10022026 · Reddit Post
• https://twitter.com/_cvereports/status/2020945821403873295 · Twitter Post