Nixpkgs security tracker
NIXPKGS-2026-0204
GitHub issue
published 5 months, 3 weeks ago
Permalink
CVE-2026-25479
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
3 packages
- python312Packages.litestar-htmx
- python313Packages.litestar-htmx
- python314Packages.litestar-htmx
- @LeSuisse accepted
- @LeSuisse published on GitHub
Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.
References
-
https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4 x_refsource_CONFIRM
-
https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0 x_refsource_MISC
-
https://github.com/litestar-org/litestar/releases/tag/v2.20.0 x_refsource_MISC
Affected products
litestar
- ==< 2.20.0
Matching in nixpkgs
pkgs.litestar
Production-ready, Light, Flexible and Extensible ASGI API framework
pkgs.python312Packages.litestar
None
pkgs.python313Packages.litestar
Production-ready, Light, Flexible and Extensible ASGI API framework
pkgs.python314Packages.litestar
Production-ready, Light, Flexible and Extensible ASGI API framework
Ignored packages (3)
pkgs.python312Packages.litestar-htmx
None
pkgs.python313Packages.litestar-htmx
HTMX Integration for Litesstar
pkgs.python314Packages.litestar-htmx
HTMX Integration for Litesstar
Package maintainers
-
@Bot-wxt1221 Bot-wxt1221 <3264117476@qq.com>