litestar-org/litestar Security Advisories | GitStock

medium2026-06-10

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

GHSA-3qmc-cj7q-62hv · CVE-2026-48061

high2026-06-10

Litestar has HTML Injection Through its CSRF Token

GHSA-542p-wvx7-72m4 · CVE-2026-48060

medium2026-02-09

Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

GHSA-vxqx-rh46-q2pg · CVE-2026-25480

medium2026-02-09

Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns

GHSA-93ph-p7v4-hwh4 · CVE-2026-25479

high2026-02-09

Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

GHSA-2p2x-hpg8-cqp2 · CVE-2026-25478

high2025-10-06

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

GHSA-hm36-ffrh-c77c · CVE-2025-59152

low2025-08-11

Litestar has potential log injection in exception logging

GHSA-674p-xv2x-rf3g

high2024-11-20

Litestar allows unbounded resource consumption (DoS vulnerability)

GHSA-gjcc-jvgw-wvwj · CVE-2024-52581

high2024-05-06

Litestar and Starlite vulnerable to Path Traversal

GHSA-83pv-qr33-2vcf · CVE-2024-32982