MEDIUM6.5

PYSEC-2026-2196

Quick fix

PYSEC-2026-2196 — litestar: upgrade to the fixed version with the command below.

pip install --upgrade 'litestar>=2.20.0'

Details

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname. This vulnerability is fixed in 2.20.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/litestar

Introduced in: 0Fixed in: 2.20.0

Fixpip install --upgrade 'litestar>=2.20.0'

References

https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0[ADVISORY]
https://github.com/litestar-org/litestar/releases/tag/v2.20.0[ADVISORY]
https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace[FIX]
https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4[EVIDENCE]