{"data":{"id":"e5d503d4-dada-4a2e-a21d-c9b40c23e4d6","title":"CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability","summary":"Kludex Starlette contains an HTTP request/response smuggling vulnerability (a technique where attackers manipulate how web servers process requests and responses) that allows attackers to inject malicious paths into the host part of a URL, potentially bypassing authentication systems that rely on checking the URL's path. This vulnerability is being actively exploited by attackers in the wild.","solution":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each system's internet exposure and ensure adherence to BOD 26-04 patching guidelines by the due date of 2026-09-16.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710","publishedAt":"2026-09-02T00:00:00.000Z","cveId":"CVE-2026-48710","cweIds":["CWE-444"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["LangChain"],"affectedVendorsRaw":["Starlette","Kludex Starlette"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"active","epssScore":0.02099,"patchAvailable":true,"disclosureDate":"2026-09-02T00:00:00.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":["AML.T0051"]}}