Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix security: pin patched Starlette for CVE-2026-48710 BadHost

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Starlette versions before 1.0.1 are affected by CVE-2026-48710 / "BadHost", a Host-header parsing issue that can let path-based authorization checks see a different path than the ASGI router dispatches.

Hermes currently pulls Starlette only transitively through optional FastAPI/MCP surfaces. A fresh lock resolution had Starlette 0.52.1, and local installs can resolve vulnerable pre-1.0.1 versions unless Hermes pins a patched Starlette release directly for the extras that expose Starlette-backed HTTP/MCP surfaces.

Root Cause

Starlette versions before 1.0.1 are affected by CVE-2026-48710 / "BadHost", a Host-header parsing issue that can let path-based authorization checks see a different path than the ASGI router dispatches.

Hermes currently pulls Starlette only transitively through optional FastAPI/MCP surfaces. A fresh lock resolution had Starlette 0.52.1, and local installs can resolve vulnerable pre-1.0.1 versions unless Hermes pins a patched Starlette release directly for the extras that expose Starlette-backed HTTP/MCP surfaces.

Fix Action

Fix / Workaround

Starlette versions before 1.0.1 are affected by CVE-2026-48710 / "BadHost", a Host-header parsing issue that can let path-based authorization checks see a different path than the ASGI router dispatches.

Hermes currently pulls Starlette only transitively through optional FastAPI/MCP surfaces. A fresh lock resolution had Starlette 0.52.1, and local installs can resolve vulnerable pre-1.0.1 versions unless Hermes pins a patched Starlette release directly for the extras that expose Starlette-backed HTTP/MCP surfaces.

Hermes should directly pin a patched Starlette release for every extra that brings in Starlette-backed server components, so pip/uv installs cannot resolve a vulnerable transitive Starlette version.

RAW_BUFFERClick to expand / collapse

Summary

Starlette versions before 1.0.1 are affected by CVE-2026-48710 / "BadHost", a Host-header parsing issue that can let path-based authorization checks see a different path than the ASGI router dispatches.

Hermes currently pulls Starlette only transitively through optional FastAPI/MCP surfaces. A fresh lock resolution had Starlette 0.52.1, and local installs can resolve vulnerable pre-1.0.1 versions unless Hermes pins a patched Starlette release directly for the extras that expose Starlette-backed HTTP/MCP surfaces.

Affected Hermes surfaces

  • web extra: dashboard / FastAPI / uvicorn
  • mcp extra: MCP HTTP/SSE stack
  • computer-use extra: MCP client/server dependencies
  • dev extra: pulls MCP for development/test environments

Expected behavior

Hermes should directly pin a patched Starlette release for every extra that brings in Starlette-backed server components, so pip/uv installs cannot resolve a vulnerable transitive Starlette version.

References

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Hermes should directly pin a patched Starlette release for every extra that brings in Starlette-backed server components, so pip/uv installs cannot resolve a vulnerable transitive Starlette version.

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - 💡(How to fix) Fix security: pin patched Starlette for CVE-2026-48710 BadHost