This vulnerability is confirmed to be actively exploited in the wild, posing a severe risk of security control bypasses in applications using the Starlette framework.

The framework fails to validate the HTTP Host header before using it to reconstruct request URLs. An unauthenticated attacker can supply a malformed header to cause a discrepancy between the raw request path and the application internal URL path, effectively bypassing security middleware.

The ability to bypass security restrictions at the framework level can lead to unauthorized access to sensitive application endpoints, potential data exposure, or the circumvention of authentication requirements. Given the CVSS score of 9.5 and the confirmation of active exploitation by CISA, this vulnerability represents a critical threat to the integrity and confidentiality of any business logic protected by Starlette middleware.

Immediate Action: Upgrade the Starlette package to version 1.0.1 or higher immediately to ensure proper Host header validation.

Proactive Monitoring: Review application logs for unusual HTTP request patterns, specifically focusing on malformed Host headers or unexpected path discrepancies in incoming traffic.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to strictly validate HTTP Host headers and block requests that deviate from expected standards as a temporary measure until patching is complete.

Public Exploit Available: Yes — multiple public proof-of-concept repositories exist on GitHub.

The presence of confirmed active exploitation necessitates immediate remediation. Organizations utilizing the Starlette framework must prioritize updating to version 1.0.1 to mitigate this critical risk. Delaying the application of this update leaves systems vulnerable to trivial exploitation and potential unauthorized access to protected resources.