Vulnerabilities for litestar

First version without a known vulnerability: 2.22.0

Details

• GHSA-3qmc-cj7q-62hv2026-06-10

  Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

  Fixed in: 2.22.0

• GHSA-542p-wvx7-72m42026-06-10

  Litestar has HTML Injection Through its CSRF Token

  Fixed in: 2.22.0

• GHSA-vxqx-rh46-q2pg2026-02-09

  Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

  Fixed in: 2.20.0

• GHSA-93ph-p7v4-hwh42026-02-09

  Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns

  Fixed in: 2.20.0

• GHSA-2p2x-hpg8-cqp22026-02-09

  Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins

  Fixed in: 2.20.0

• GHSA-hm36-ffrh-c77c2025-10-06

  Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

  Fixed in: 2.18.0

• GHSA-674p-xv2x-rf3g2025-08-11

  Litestar has potential log injection in exception logging

  Fixed in: 2.17.0

• GHSA-gjcc-jvgw-wvwj2024-11-20

  Litestar allows unbounded resource consumption (DoS vulnerability)

  Fixed in: 2.13.0, 53c1473b5ff7502816a9a339ffc90731bb0c2138

• GHSA-83pv-qr33-2vcf2024-05-06

  Litestar and Starlite vulnerable to Path Traversal

  Fixed in: 2.8.3, 1.51.16, 2.7.2, 2.6.4