Dependency constraint prevents patched Starlette release for CVE-2026-48710

[josemariacampo]

The current dependency specification in pyproject.toml restricts Starlette to versions below 1.0.0:

"starlette>=0.37.0,<1.0.0; python_version>='3.8'",

A security issue tracked as CVE-2026-48710 has been fixed in Starlette 1.0.1, but the current upper bound prevents downstream users from upgrading to a patched version through normal dependency resolution.

References

• https://www.cve.org/CVERecord?id=CVE-2026-48710
• https://app.opencve.io/cve/CVE-2026-48710

[afeld]

Additional reference: https://osv.dev/vulnerability/PYSEC-2026-161

[HelloVet-Luke]

Title: Transitive dependency starlette==0.52.1 contains known vulnerability PYSEC-2026-161 (CVE-2026-48710)

---

Describe the issue

functions-framework==3.10.1 pins starlette==0.52.1 as a transitive dependency. This version of starlette contains a known vulnerability:

• ID: PYSEC-2026-161 / CVE-2026-48710 / GHSA-86qp-5c8j-p5mr
• Summary: "BadHost" — starlette fails to validate the HTTP Host request header before using it to reconstruct request.url.path, allowing attackers to inject path components that prepend the actual request path. This can lead to authentication bypass when authentication depends on the reconstructed URL path.
• CVSS: 6.5 (Medium)
• Fixed in: starlette 1.0.1
• Published: 2026-05-22

Steps to reproduce

pip install functions-framework==3.10.1
pip freeze > requirements.txt
pip-audit -r requirements.txt

Output:

Found 2 known vulnerabilities in 1 package
Name      Version ID             Fix Versions
starlette 0.52.1  PYSEC-2026-161 1.0.1
starlette 0.52.1  PYSEC-2026-161 1.0.1

Attempting to manually upgrade starlette fails due to a dependency conflict:

pip install "starlette>=1.0.1"
# ERROR: Cannot install requirements.txt and starlette==1.3.0 because these package versions have conflicting dependencies.

Expected behaviour

functions-framework should pin starlette>=1.0.1 to resolve this CVE. Users running pip-audit against their frozen requirements will receive security warnings they cannot resolve without breaking their installation.

Environment

• functions-framework==3.10.1
• starlette==0.52.1 (pinned by functions-framework)
• Python 3.14
• pip-audit 2.10.1

References

• https://osv.dev/vulnerability/PYSEC-2026-161
• GHSA-86qp-5c8j-p5mr
• https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette

[afeld]

Full list of relevant vulnerabilities.

[afeld]

Fix being released in v3.10.2 👀