Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
litestar-org litestar
< 2.20.0affected
References
- https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4 ↗
- https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace ↗
- https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 ↗
- https://github.com/litestar-org/litestar/releases/tag/v2.20.0 ↗