CVE-2026-25479

CVE-2026-25479 affects the Litestar ASGI framework prior to version 2.20.0, where a flaw in the allowed_hosts middleware allows attackers to bypass hostname restrictions. The vulnerability stems from improper regex compilation of allowlist entries, enabling an attacker to craft a malicious host that matches the regex pattern but is not the intended literal hostname. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and can lead to limited confidentiality and integrity impacts, as it can be exploited remotely without authentication. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.