Join our Newsletter — 33% off our NHI Course

CVE-2026-48710 (Kludex Starlette HTTP Request/Response Smuggling)

CVE-2026-48710 is a HTTP request/response smuggling vulnerability in Kludex Starlette. CISA added it to the Known Exploited Vulnerabilities catalogue on 2 September 2026, which means attackers have used it in real attacks. This vulnerability could be chaned with CVE-2026-42271.

What Request/Response Smuggling Means in a Web Framework

HTTP request/response smuggling is dangerous because it exploits differences in how intermediaries and back-end components parse the same traffic. In practice, a single malformed request can be interpreted in two different ways, which can let an attacker desynchronise the request stream and influence what the application actually receives.

In a framework such as Starlette, the issue matters because the framework sits close to the application boundary, where request parsing, header handling and response framing all affect trust. When those boundaries are inconsistent, the attacker may be able to tunnel data past expected controls or interfere with the next request on a shared connection.

Why CVE-2026-48710 Is Dangerous

Because this CVE is a request/response smuggling flaw, the core danger is not just one malformed request. It is the possibility of crossing a trust boundary in a way that changes the meaning of later traffic, especially when proxies, gateways, load balancers or shared connection pools are involved.

Request smuggling and response splitting patterns are especially risky when different components disagree on message length or framing. That mismatch can be used to bypass filtering, poison downstream responses, or interfere with another user’s session on the same infrastructure.

MITRE ATT&CK Enterprise is a useful lens here because request smuggling often acts as an access path rather than a final objective. The technique can support stealthy reach into internal services, follow-on exploitation, or session manipulation once the parser confusion is established.

How Organisations Check Exposure and Reduce Blast Radius

The first exposure question is architectural: is Starlette deployed behind a reverse proxy, API gateway, edge cache or other intermediary that rewrites or normalises HTTP traffic? If so, the organisation should verify that every hop handles framing, transfer encoding and connection reuse consistently.

NIST National Vulnerability Database and the CVE Program remain the authoritative places to confirm the record, scope and naming of the issue, while the vendor advisory should be used for version-specific remediation details. Organisations should also inventory where Starlette appears in production, because internet-facing deployments and shared ingress layers increase practical exposure.

Vulnerability management guidance is relevant because smuggling flaws need rapid prioritisation when they are known exploited. Asset scope, external exposure, exception handling and verification matter more than generic patch queues when an attacker can already use the flaw in real attacks.

Detection, Remediation and Identity-Adjacent Consequences

Detection is often about abnormal traffic relationships rather than a single signature. Watch for inconsistent request counts, unexpected connection reuse, duplicate or truncated requests, unexplained 400-series errors, proxy and application log mismatches, and downstream requests that appear to arrive “out of order”.

The State of NHI & AI Agent Breach Report 2026 illustrates the broader lesson that once an attacker can manipulate trusted application traffic, they often go after sessions, tokens and API keys next. For a smuggling flaw, post-incident review should therefore include credential and session review wherever the compromised path could have exposed authenticated traffic or internal service requests.

When patching is delayed, compensating controls should reduce ambiguity at the edge: tighten proxy normalisation, limit connection reuse where feasible, isolate high-risk routes, and increase inspection on the affected service path. After remediation, review logs and session state for signs that the issue was used before the fix landed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
OWASP ASVS V4 — API and Web Service Security Verification Request smuggling is a web service parsing and message-handling flaw.
V15 — Secure Coding and Architecture The flaw reflects an architectural trust-boundary failure in request processing.
Recommendation — Verify request parsing and message framing across the API stack. Review framing, proxy trust boundaries and parser consistency in the service design.
NIST SP 800-53 Rev 5 SI-10 — Information Input Validation Smuggling exploits inconsistent handling of crafted HTTP input.
SC-7 — Boundary Protection The issue arises at the boundary between clients, intermediaries and back-end services.
Recommendation — Validate HTTP inputs and reject malformed framing before processing. Harden and monitor boundary devices that normalize HTTP traffic.
CIS Controls v8 CIS-16 — Application Software Security Application-layer parsing flaws are addressed through secure software controls.
Recommendation — Test application traffic handling and remediate parsing weaknesses quickly.