Advisories » MGASA-2026-0413

Updated python-starlette package fixes security vulnerabilities

Publication date: 17 Sep 2026
Modification date: 17 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48817 , CVE-2026-54282 , CVE-2026-54283

Description

Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via
`getattr`. (CVE-2026-48817)
Unvalidated request path concatenated into authority poisons
request.url.hostname. (CVE-2026-54282)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36224
• https://lists.debian.org/debian-security-announce/2026/msg00389.html
• https://www.cve.org/CVERecord?id=CVE-2026-48817
• https://www.cve.org/CVERecord?id=CVE-2026-54282
• https://www.cve.org/CVERecord?id=CVE-2026-54283

SRPMS

10/core

• python-starlette-0.46.0-3.2.mga10