litellm - 💡(How to fix) Fix [Bug]: fastapi==0.124.4 pin blocks starlette CVE-2026-48710 (BadHost)

Check for existing issues

• I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

Summary

LiteLLM's exact-pin fastapi==0.124.4 (in main, v1.86.1, v1.87.0-rc.2, and the v1.83.14-stable.patch.* series) transitively constrains starlette to >=0.40.0,<0.51.0, which resolves to starlette==0.50.0 — affected by CVE-2026-48710 ("BadHost"), a Host-header validation gap that lets an attacker forge request.url.path and bypass path-based auth. Fix is in starlette 1.0.1, but LiteLLM's pin prevents it from resolving.

Container scanners flag every published LiteLLM image as critical, and operators can't mitigate without forking — grep -r "from starlette" litellm/ returns ~68 hits including proxy/auth/* and proxy/middleware/*, which is exactly the surface BadHost targets.

Caveat

0.124 → 0.133+ crosses 6 FastAPI breaking-change releases plus the starlette 0.50 → 1.0 major. The 68 direct starlette imports need vetting against the 1.0 API. Not a "just bump it" ask — flagging because the CVE has no in-tree mitigation.

Refs

• BadHost disclosure: https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
• CVE-2026-48710: https://vulnerability.circl.lu/vuln/cve-2026-48710
• FastAPI 0.133.0 (first allows starlette 1.0.x): https://github.com/fastapi/fastapi/releases/tag/0.133.0

Steps to Reproduce

docker run --rm --entrypoint sh ghcr.io/berriai/litellm:v1.86.1 -c \
  "ls /app/.venv/lib/python*/site-packages/ | grep -E '^(fastapi|starlette)-[0-9]'"
# fastapi-0.124.4.dist-info
# starlette-0.50.0.dist-info

FastAPI 0.124.4's metadata: starlette<0.51.0,>=0.40.0.

Relevant log output

What part of LiteLLM is this about?

SDK (litellm Python package)

What LiteLLM version are you on ?

v1.83.14-stable.patch.1

Twitter / LinkedIn details

No response