{"schema":"vulnpedia.research/1","cve":"CVE-2026-48710","references":[{"url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","tags":["x_refsource_CONFIRM","Vendor Advisory","WEB","EVIDENCE","ADVISORY","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"}]},{"url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6","tags":["x_refsource_MISC","Patch","WEB","FIX","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"}]},{"url":"https://badhost.org/","tags":["x_refsource_MISC","Mitigation","Third Party Advisory","WEB","ARTICLE","DETECTION","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","url":"https://badhost.org/"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://badhost.org/"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://badhost.org/"},{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://badhost.org/"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://badhost.org/"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://badhost.org/"}]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml","tags":["x_refsource_MISC","Third Party Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"}]},{"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette","tags":["x_refsource_MISC","Mitigation","Third Party Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"}]},{"url":"https://www.secwest.net/starlette","tags":["x_refsource_MISC","Exploit","Mitigation","Third Party Advisory","WEB","ARTICLE","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","url":"https://www.secwest.net/starlette"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://www.secwest.net/starlette"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://www.secwest.net/starlette"},{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://www.secwest.net/starlette"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://www.secwest.net/starlette"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://www.secwest.net/starlette"}]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette","tags":["x_refsource_MISC","Exploit","Mitigation","Third Party Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-05-26T21:54:54.393Z","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"}]},{"url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points","tags":["third-party-advisory","Broken Link"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-01T17:41:26.242Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-01T17:41:26.242Z","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points"}]},{"url":"https://www.wiz.io/blog/ai-infrastructure-honeypot","tags":["third-party-advisory","Exploit","Third Party Advisory","KEV report"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-01T17:41:26.242Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-01T17:41:26.242Z","url":"https://www.wiz.io/blog/ai-infrastructure-honeypot"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://www.wiz.io/blog/ai-infrastructure-honeypot"},{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","url":"https://www.wiz.io/blog/ai-infrastructure-honeypot"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710","tags":["government-resource","Third Party Advisory","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-01T17:41:26.242Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-01T17:41:26.242Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48710","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/security/cve/CVE-2026-48710"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/security/cve/CVE-2026-48710"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/security/cve/CVE-2026-48710"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/security/cve/CVE-2026-48710"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-48710"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","tags":["x_sadp-csaf-vex","Third Party Advisory","WEB","vendor-advisory"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:30089"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:30088"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:24866"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:23346","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:23346"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:23346"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:23346"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:23346"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:23346"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:43038","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:43038"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:37275"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:60520"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:34456","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:34456"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:44696","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:44696"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:22993","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:22993"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:22993"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:22993"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:22993"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:22993"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:26226","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:26226"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:26226"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:26226"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:26226"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:26226"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:51357","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:51357"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:22992","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:22992"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:22992"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:22992"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:22992"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:22992"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:34532","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:34532"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:34532"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:34532"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:34532"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:34532"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:34526","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","WEB","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:34526"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:34526"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://access.redhat.com/errata/RHSA-2026:34526"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://access.redhat.com/errata/RHSA-2026:34526"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:34526"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:63337","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","vendor-remediation"],"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","origins":[{"source":"mitre","sourceId":"redhat-SADP","modified":"2026-09-04T12:05:00.370Z","url":"https://access.redhat.com/errata/RHSA-2026:63337"},{"source":"nvd","sourceId":"CVE-2026-48710","modified":"2026-10-01T18:17:18.153","url":"https://access.redhat.com/errata/RHSA-2026:63337"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:63337"}]},{"url":"https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","origins":[{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","origins":[{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48710","tags":["WEB","vendor-reference"],"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","origins":[{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"}]},{"url":"https://github.com/Kludex/starlette","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","origins":[{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://github.com/Kludex/starlette"},{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://github.com/Kludex/starlette"}]},{"url":"https://osv.dev/vulnerability/PYSEC-2026-161","tags":["ADVISORY"],"source":"pysec","sourceId":"PYSEC-2026-161","modified":"2026-05-26T15:41:31.112064345Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://osv.dev/vulnerability/PYSEC-2026-161"},{"source":"pysec","sourceId":"PYSEC-2026-161","modified":"2026-05-26T15:41:31.112064345Z","url":"https://osv.dev/vulnerability/PYSEC-2026-161"}]},{"url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/","tags":["ARTICLE"],"source":"pysec","sourceId":"PYSEC-2026-161","modified":"2026-05-26T15:41:31.112064345Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/"},{"source":"pysec","sourceId":"PYSEC-2026-161","modified":"2026-05-26T15:41:31.112064345Z","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/"}]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/","tags":["ADVISORY"],"source":"pysec","sourceId":"PYSEC-2026-161","modified":"2026-05-26T15:41:31.112064345Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/"},{"source":"pysec","sourceId":"PYSEC-2026-161","modified":"2026-05-26T15:41:31.112064345Z","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:69464","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:69464"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:76150","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:76150"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:73987","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:73987"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:69466","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:69466"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:70965","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:70965"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:70979","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:70979"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:69467","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:69467"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:70969","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:70969"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:76149","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:76149"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87410","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87410"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:84734","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:84734"}]},{"source":"euvd","sourceId":"EUVD-2026-32016","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-32016","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-32016","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-32016"}]},{"url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/"}]},{"url":"https://previdian.com/CVE-2026-48710","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","url":"https://previdian.com/CVE-2026-48710"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://vulncheck.com/xdb/9d8edc626108","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"9d8edc626108","modified":"2026-05-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9d8edc626108","modified":"2026-05-26T00:00:00Z","url":"https://vulncheck.com/xdb/9d8edc626108"}]},{"url":"https://github.com/CuteeCat/CVE-2026-48710","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"9d8edc626108","modified":"2026-05-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9d8edc626108","modified":"2026-05-26T00:00:00Z","url":"https://github.com/CuteeCat/CVE-2026-48710"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","url":"https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr","ecosystem":"PyPI","name":"starlette","purl":"pkg:pypi/starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.2.2","0.2.3","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.0","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1"],"databaseSpecific":{"last_known_affected_version_range":"<= 1.0.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-86qp-5c8j-p5mr/GHSA-86qp-5c8j-p5mr.json"},"modified":"2026-09-10T03:51:08.121685407Z","origins":[{"source":"ghsa","sourceId":"GHSA-86qp-5c8j-p5mr","modified":"2026-09-10T03:51:08.121685407Z","url":"https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr"}]},{"source":"pysec","sourceId":"PYSEC-2026-161","url":"https://osv.dev/vulnerability/PYSEC-2026-161","ecosystem":"PyPI","name":"starlette","purl":"pkg:pypi/starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.10.7","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.12.0","0.12.0b1","0.12.0b2","0.12.0b3","0.12.1","0.12.10","0.12.11","0.12.12","0.12.13","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.2.0","0.2.1","0.2.2","0.2.3","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.23.0","0.23.1","0.24.0","0.25.0","0.26.0","0.26.0.post1","0.26.1","0.27.0","0.28.0","0.29.0","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.31.0","0.31.1","0.32.0","0.32.0.post1","0.33.0","0.34.0","0.35.0","0.35.1","0.36.0","0.36.1","0.36.2","0.36.3","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","0.38.2","0.38.3","0.38.4","0.38.5","0.38.6","0.39.0","0.39.1","0.39.2","0.4.0","0.4.1","0.4.2","0.40.0","0.41.0","0.41.1","0.41.2","0.41.3","0.42.0","0.43.0","0.44.0","0.45.0","0.45.1","0.45.2","0.45.3","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.47.2","0.47.3","0.48.0","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.50.0","0.51.0","0.52.0","0.52.1","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1"],"databaseSpecific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/starlette/PYSEC-2026-161.yaml"},"modified":"2026-05-26T15:41:31.112064345Z","origins":[{"source":"pysec","sourceId":"PYSEC-2026-161","modified":"2026-05-26T15:41:31.112064345Z","url":"https://osv.dev/vulnerability/PYSEC-2026-161"}]}],"pocCandidates":[{"url":"https://github.com/eris-ths/supply-chain-guard","source":"poc-in-github","sourceId":"CVE-2026-48710","description":"Detect, assess, and respond to supply chain attacks across npm/yarn and Python (pip/poetry/uv). Claude Code skill + standalone scripts. Built during axios RAT (2026-03-31) and Starlette BadHost CVE-2026-48710 (2026-05-22).","modified":"2026-07-02T08:59:49Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48710","url":"https://github.com/eris-ths/supply-chain-guard"},{"source":"poc-in-github","sourceId":"CVE-2026-48710","modified":"2026-07-02T08:59:49Z","url":"https://github.com/eris-ths/supply-chain-guard"}],"tags":[]},{"url":"https://github.com/xtremebeing/starlette-host-header-lab","source":"poc-in-github","sourceId":"CVE-2026-48710","description":"Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710","modified":"2026-05-27T10:00:25Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48710","url":"https://github.com/xtremebeing/starlette-host-header-lab"},{"source":"poc-in-github","sourceId":"CVE-2026-48710","modified":"2026-05-27T10:00:25Z","url":"https://github.com/xtremebeing/starlette-host-header-lab"}],"tags":[]},{"url":"https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit","source":"poc-in-github","sourceId":"CVE-2026-48710","description":"Detection scanner for CVE-2026-48710 - Host-header auth bypass in Starlette/FastAPI","modified":"2026-07-09T12:41:38Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48710","url":"https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit"},{"source":"poc-in-github","sourceId":"CVE-2026-48710","modified":"2026-07-09T12:41:38Z","url":"https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit"}],"tags":[]},{"url":"https://github.com/sb-ox/repro-OXDEV-77637-uv-workspace","source":"poc-in-github","sourceId":"CVE-2026-48710","description":"OXDEV-77637 repro fixture: uv workspace whose transitive CVE (starlette 0.25.0 / CVE-2026-48710) is dropped when the lean clone omits workspace-member pyproject.toml. Tag: repro-OXDEV-77637","modified":"2026-08-03T16:25:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48710","url":"https://github.com/sb-ox/repro-OXDEV-77637-uv-workspace"},{"source":"poc-in-github","sourceId":"CVE-2026-48710","modified":"2026-08-03T16:25:41Z","url":"https://github.com/sb-ox/repro-OXDEV-77637-uv-workspace"}],"tags":[]},{"url":"https://github.com/CuteeCat/CVE-2026-48710","source":"poc-in-github","sourceId":"CVE-2026-48710","description":"CVE-2026-48710漏洞验证代码","modified":"2026-08-11T08:42:36Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48710","url":"https://github.com/CuteeCat/CVE-2026-48710"},{"source":"poc-in-github","sourceId":"CVE-2026-48710","modified":"2026-08-11T08:42:36Z","url":"https://github.com/CuteeCat/CVE-2026-48710"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"9d8edc626108","url":"https://vulncheck.com/xdb/9d8edc626108","cve":"CVE-2026-48710","dateAdded":"2026-08-12T15:54:03Z","modified":"2026-05-26T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/CuteeCat/CVE-2026-48710","observations":[{"dateAdded":"2026-08-12T15:54:03Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"9d8edc626108","modified":"2026-05-26T00:00:00Z","url":"https://vulncheck.com/xdb/9d8edc626108"}]}],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64","product":"registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 as a component of Red Hat AI Inference Server 3.3","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:30089","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/vllm-cuda-rhel9@sha256%3A9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309?arch=arm64&repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9&tag=1782352847","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat AI Inference Server 3.4:registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:8f3b2de1d5a8fdba70e937ff1ab95c0584cec32a4d58b1e636ea130a6461cea1_amd64","product":"registry.redhat.io/rhaii/vllm-spyre-rhel9@sha256:8f3b2de1d5a8fdba70e937ff1ab95c0584cec32a4d58b1e636ea130a6461cea1_amd64 as a component of Red Hat AI Inference Server 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For more information visit https://access.redhat.com/errata/RHSA-2026:69464","url":"https://access.redhat.com/errata/RHSA-2026:69464"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/vllm-spyre-rhel9@sha256%3A8f3b2de1d5a8fdba70e937ff1ab95c0584cec32a4d58b1e636ea130a6461cea1?arch=amd64&repository_url=registry.redhat.io/rhaii/vllm-spyre-rhel9&tag=1789681201","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat Enterprise Linux AI 3.4:registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9@sha256:c1a193fa047eedbbf52be0b1d0f5d52e3e572d144a871f7c9322a34ba5abd92f_amd64","product":"registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9@sha256:c1a193fa047eedbbf52be0b1d0f5d52e3e572d144a871f7c9322a34ba5abd92f_amd64 as a component of Red Hat Enterprise Linux AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.\n\nFor details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.4","url":"https://access.redhat.com/errata/RHSA-2026:76150"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/bootc-gcp-cuda-rhel9@sha256%3Ac1a193fa047eedbbf52be0b1d0f5d52e3e572d144a871f7c9322a34ba5abd92f?arch=amd64&repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9&tag=1790881123","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.3:registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:7c191c82302255ca50b047d803a20bdde14fc983e56d5c89c30fb16e0cbb7f69_amd64","product":"registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:7c191c82302255ca50b047d803a20bdde14fc983e56d5c89c30fb16e0cbb7f69_amd64 as a component of Red Hat OpenShift AI 3.3","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/odh-feature-server-rhel9@sha256%3A7c191c82302255ca50b047d803a20bdde14fc983e56d5c89c30fb16e0cbb7f69?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1782997656","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.3:registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256:5ccf83ca42677a3d86b182df4262fffaf2e5179886310593b04d015ad79d49eb_arm64","product":"registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256:5ccf83ca42677a3d86b182df4262fffaf2e5179886310593b04d015ad79d49eb_arm64 as a component of Red Hat OpenShift AI 3.3","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.3.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:73987"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256%3A5ccf83ca42677a3d86b182df4262fffaf2e5179886310593b04d015ad79d49eb?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9&tag=1790085310","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.3:registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:902bbeae50713b093e5e516a975c82241745c9f0b99051124120c503c38c919e_arm64","product":"registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:902bbeae50713b093e5e516a975c82241745c9f0b99051124120c503c38c919e_arm64 as a component of Red Hat OpenShift AI 3.3","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256%3A902bbeae50713b093e5e516a975c82241745c9f0b99051124120c503c38c919e?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9&tag=1782471661","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:c47f990eda9a49490c89d23f5e8ad0e9e394de95247d389c106d27b48a64240e_arm64","product":"registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:c47f990eda9a49490c89d23f5e8ad0e9e394de95247d389c106d27b48a64240e_arm64 as a component of Red Hat OpenShift AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/odh-feature-server-rhel9@sha256%3Ac47f990eda9a49490c89d23f5e8ad0e9e394de95247d389c106d27b48a64240e?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1787068065","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9@sha256:f4dc82dead9aafc9f3c285e489fb04193105b864a518dee52c21a922693c94c8_s390x","product":"registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9@sha256:f4dc82dead9aafc9f3c285e489fb04193105b864a518dee52c21a922693c94c8_s390x as a component of Red Hat OpenShift AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.4.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/odh-pipeline-runtime-datascience-cpu-py312-rhel9@sha256%3Af4dc82dead9aafc9f3c285e489fb04193105b864a518dee52c21a922693c94c8?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9&tag=1782132686","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9@sha256:a796d1bb0bcd95acd9c66e185789d78e614ee8b53d9ef6efcbf4ba211c916a3a_ppc64le","product":"registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9@sha256:a796d1bb0bcd95acd9c66e185789d78e614ee8b53d9ef6efcbf4ba211c916a3a_ppc64le as a component of Red Hat OpenShift AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.4.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/odh-trustyai-nemo-guardrails-server-rhel9@sha256%3Aa796d1bb0bcd95acd9c66e185789d78e614ee8b53d9ef6efcbf4ba211c916a3a?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9&tag=1782420349","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9@sha256:803c490b945de2bd3168c134b4807f999adaeacfb4b134bce1c618bc2f5be9cd_arm64","product":"registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9@sha256:803c490b945de2bd3168c134b4807f999adaeacfb4b134bce1c618bc2f5be9cd_arm64 as a component of Red Hat OpenShift AI 3.4","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat OpenShift AI 3.4.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9@sha256%3A803c490b945de2bd3168c134b4807f999adaeacfb4b134bce1c618bc2f5be9cd?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9&tag=1782301637","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64","product":"registry.redhat.io/satellite/iop-vulnerability-engine-rhel9@sha256:18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc_amd64 as a component of Red Hat Satellite 6.19","status":"fixed","remediations":[{"category":"vendor_fix","details":"For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.","url":"https://access.redhat.com/errata/RHSA-2026:63337"},{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}],"purl":"pkg:oci/iop-vulnerability-engine-rhel9@sha256%3A18805dc252fdc1c979e2324f61cc8e23b113b15c596a74d0efefd005aa85fbbc?arch=amd64&repository_url=registry.redhat.io/satellite/iop-vulnerability-engine-rhel9&tag=1788190224","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"openshift_lightspeed:openshift-lightspeed/lightspeed-service-api-rhel9","product":"openshift-lightspeed/lightspeed-service-api-rhel9 as a component of OpenShift Lightspeed","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/lightspeed-service-api-rhel9?repository_url=registry.redhat.io/openshift-lightspeed/lightspeed-service-api-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_ai_inference_server:rhaii/vllm-neuron-rhel9","product":"rhaii/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:oci/vllm-neuron-rhel9?repository_url=registry.redhat.io/rhaii/vllm-neuron-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-cpu-rhel9","product":"rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:oci/vllm-cpu-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-spyre-rhel9","product":"rhaiis/vllm-spyre-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/vllm-spyre-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_ansible_automation_platform_2:ansible-automation-platform-25/lightspeed-chatbot-rhel8","product":"ansible-automation-platform-25/lightspeed-chatbot-rhel8 as a component of Red Hat Ansible Automation Platform 2","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:oci/lightspeed-chatbot-rhel8?repository_url=registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-caikit-tgis-serving-rhel9","product":"rhoai/odh-caikit-tgis-serving-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-caikit-tgis-serving-rhel9?repository_url=registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-llm-d-kv-cache-rhel9","product":"rhoai/odh-llm-d-kv-cache-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-llm-d-kv-cache-rhel9?repository_url=registry.redhat.io/rhoai/odh-llm-d-kv-cache-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9","product":"rhoai/odh-th06-cpu-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-th06-cpu-torch210-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-vllm-cuda-rhel9","product":"rhoai/odh-vllm-cuda-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-vllm-cuda-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-vllm-rocm-rhel9","product":"rhoai/odh-vllm-rocm-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-vllm-rocm-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat Ansible Automation Platform 2.6:registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:3362761d6a5d99330d303adc87e1181369243147d56347362bfba62cc8047081_s390x","product":"registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:3362761d6a5d99330d303adc87e1181369243147d56347362bfba62cc8047081_s390x as a component of Red Hat Ansible Automation Platform 2.6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/aap-must-gather-rhel9@sha256%3A3362761d6a5d99330d303adc87e1181369243147d56347362bfba62cc8047081?arch=s390x&repository_url=registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9&tag=1779755048","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 2.25:registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:6c96958505eaac04880ffdc1ed29bace5f70836d7a14c91edb4dcbc51f762efb_ppc64le","product":"registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:6c96958505eaac04880ffdc1ed29bace5f70836d7a14c91edb4dcbc51f762efb_ppc64le as a component of Red Hat OpenShift AI 2.25","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-kserve-storage-initializer-rhel9@sha256%3A6c96958505eaac04880ffdc1ed29bace5f70836d7a14c91edb4dcbc51f762efb?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9&tag=1791257289","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.3:registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:f5cdd9a6edcc3638fed8ebf152f77964f145faadb8cb2556bfe5f8815a2573a2_arm64","product":"registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:f5cdd9a6edcc3638fed8ebf152f77964f145faadb8cb2556bfe5f8815a2573a2_arm64 as a component of Red Hat OpenShift AI 3.3","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-data-science-pipelines-operator-controller-rhel9@sha256%3Af5cdd9a6edcc3638fed8ebf152f77964f145faadb8cb2556bfe5f8815a2573a2?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9&tag=1790133374","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.3:registry.redhat.io/rhoai/odh-model-metadata-collection-rhel9@sha256:053c9dbca6c20e761fce20802068e5ef7394a11bc73a06951a83f1f4f1fad200_amd64","product":"registry.redhat.io/rhoai/odh-model-metadata-collection-rhel9@sha256:053c9dbca6c20e761fce20802068e5ef7394a11bc73a06951a83f1f4f1fad200_amd64 as a component of Red Hat OpenShift AI 3.3","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-model-metadata-collection-rhel9@sha256%3A053c9dbca6c20e761fce20802068e5ef7394a11bc73a06951a83f1f4f1fad200?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-model-metadata-collection-rhel9&tag=1782471601","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.3:registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256:7c273bde8dc45b4c63669e8ae71f166fd084857f8474b589a7fba491c75d9087_amd64","product":"registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256:7c273bde8dc45b4c63669e8ae71f166fd084857f8474b589a7fba491c75d9087_amd64 as a component of Red Hat OpenShift AI 3.3","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-workbench-jupyter-pytorch-cuda-py312-rhel9@sha256%3A7c273bde8dc45b4c63669e8ae71f166fd084857f8474b589a7fba491c75d9087?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9&tag=1789651387","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9@sha256:84ae9c3a4d291831994a8275add1b214cd1fb720424bc914a886c8455e170e15_arm64","product":"registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9@sha256:84ae9c3a4d291831994a8275add1b214cd1fb720424bc914a886c8455e170e15_arm64 as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-kserve-autogluon-server-rhel9@sha256%3A84ae9c3a4d291831994a8275add1b214cd1fb720424bc914a886c8455e170e15?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9&tag=1782133320","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel9@sha256:0f34024a0529d31771a82d5cbea690bd5eb2446435e66f8630abbb88b7c53334_ppc64le","product":"registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel9@sha256:0f34024a0529d31771a82d5cbea690bd5eb2446435e66f8630abbb88b7c53334_ppc64le as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-ml-pipelines-driver-rhel9@sha256%3A0f34024a0529d31771a82d5cbea690bd5eb2446435e66f8630abbb88b7c53334?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-driver-rhel9&tag=1787333171","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-model-performance-data-rhel9@sha256:935ac44fe155287dca76338be2d8cc77bf4ec9ffff60f441fa06e2b10cc6a7a9_arm64","product":"registry.redhat.io/rhoai/odh-model-performance-data-rhel9@sha256:935ac44fe155287dca76338be2d8cc77bf4ec9ffff60f441fa06e2b10cc6a7a9_arm64 as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-model-performance-data-rhel9@sha256%3A935ac44fe155287dca76338be2d8cc77bf4ec9ffff60f441fa06e2b10cc6a7a9?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-model-performance-data-rhel9&tag=1786611344","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"Red Hat OpenShift AI 3.4:registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9@sha256:cdd7d9f982c1f8a94dd4aad43e705274aae1bf0942e0442e60c3973f9c198f23_amd64","product":"registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9@sha256:cdd7d9f982c1f8a94dd4aad43e705274aae1bf0942e0442e60c3973f9c198f23_amd64 as a component of Red Hat OpenShift AI 3.4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-th06-cpu-torch210-py312-rhel9@sha256%3Acdd7d9f982c1f8a94dd4aad43e705274aae1bf0942e0442e60c3973f9c198f23?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9&tag=1787076778","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]},{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-mlserver-rhel9","product":"rhoai/odh-mlserver-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_in_execute_path","purl":"pkg:oci/odh-mlserver-rhel9?repository_url=registry.redhat.io/rhoai/odh-mlserver-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-48710","modified":"2026-10-22T05:13:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}]}],"vendorCoverage":{"total":1847,"shown":32,"omitted":1815,"source":"redhat"},"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-05-26T00:00:00Z","modified":"2026-05-26T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Known","reportedByVulncheckCanaries":false,"vendorProject":"Kludex","product":"Starlette","dueDate":"2026-09-16T00:00:00Z","cisaDateAdded":"2026-09-02T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","modified":"2026-05-26T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","catalog":"VulnCheck KEV","kind":"report","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-32016","dateAdded":"2026-05-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-32016"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","catalog":"VulnCheck KEV","kind":"report","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/","dateAdded":"2026-08-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","catalog":"VulnCheck KEV","kind":"report","url":"https://www.wiz.io/blog/ai-infrastructure-honeypot","dateAdded":"2026-08-27T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","url":"https://www.wiz.io/blog/ai-infrastructure-honeypot"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-48710","dateAdded":"2026-09-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","url":"https://previdian.com/CVE-2026-48710"},{"source":"vulncheck-kev","sourceId":"CVE-2026-48710","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]}]}