Is CVE-2026-54282 actively exploited?

No active exploitation of CVE-2026-54282 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-54282 be exploited remotely?

Yes. CVE-2026-54282 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-54282?

CVE-2026-54282 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-54282

MEDIUM

CVE-2026-54282

CWE-706Published: June 22, 2026· Updated: Jun 26, 2026

5.3

CVSS v3.1

EPSS:0.19%probability of exploitation in 30 daysPercentile:8.3th

Official Description

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0.

NVD Source

Technical Analysis

CVE-2026-54282 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.