Description
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| ansible-automation-platform-25/lightspeed-chatbot-rhel8 | Red Hat / Red Hat Ansible Automation Platform 2 | any version | unknown |
| ansible-automation-platform-26/lightspeed-chatbot-rhel9 | Red Hat / Red Hat Ansible Automation Platform 2.6 | >= 1780102732, < * | unaffected |
| ansible-automation-platform-26/mcp-tools-rhel9 | Red Hat / Red Hat Ansible Automation Platform 2 | any version | unknown |
| ansible-automation-platform-27/lightspeed-chatbot-rhel9 | Red Hat / Red Hat Ansible Automation Platform 2.7 | >= 1780099185, < * | unaffected |
| exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Red Hat / Exploit Intelligence | any version | unknown |
| mta/mta-solution-server-rhel9 | Red Hat / Red Hat Migration Toolkit for Applications 8.2 | >= 1784109883, < * | unaffected |
| openshift-lightspeed/lightspeed-ocp-rag-rhel9 | Red Hat / OpenShift Lightspeed | any version | unknown |
| openshift-lightspeed/lightspeed-service-api-rhel9 | Red Hat / OpenShift Lightspeed | any version | unknown |
| rhaiis/vllm-cpu-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaiis/vllm-cuda-rhel9 | Red Hat / Red Hat AI Inference Server 3.3 | >= 1782352847, < * | unaffected |
| rhaiis/vllm-neuron-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaiis/vllm-rocm-rhel9 | Red Hat / Red Hat AI Inference Server 3.3 | >= 1782353093, < * | unaffected |
| rhaiis/vllm-spyre-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaiis/vllm-tpu-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaii/vllm-cpu-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaii/vllm-gaudi-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaii/vllm-neuron-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaii/vllm-spyre-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhaii/vllm-tpu-rhel9 | Red Hat / Red Hat AI Inference Server | any version | unknown |
| rhelai3/bootc-aws-cuda-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhelai3/bootc-azure-cuda-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhelai3/bootc-azure-rocm-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhelai3/bootc-cuda-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhelai3/bootc-gaudi-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhelai3/bootc-gcp-cuda-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhelai3/bootc-rocm-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhelai3/disk-image-cuda-rhel9 | Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3 | any version | unknown |
| rhoai/odh-automl-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1786612415, < * | unaffected |
| rhoai/odh-built-in-detector-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-caikit-nlp-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-caikit-tgis-serving-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-feature-server-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782997656, < * | unaffected |
| rhoai/odh-feature-server-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1787068065, < * | unaffected |
| rhoai/odh-guardrails-detector-huggingface-runtime-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-kserve-agent-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-kserve-autogluon-server-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-kserve-controller-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-kserve-router-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-kserve-storage-initializer-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-llama-stack-core-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132126, < * | unaffected |
| rhoai/odh-llm-d-kv-cache-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-mlflow-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-mlserver-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132686, < * | unaffected |
| rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471672, < * | unaffected |
| rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132403, < * | unaffected |
| rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471731, < * | unaffected |
| rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132444, < * | unaffected |
| rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471732, < * | unaffected |
| rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132767, < * | unaffected |
| rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471849, < * | unaffected |
| rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132493, < * | unaffected |
| rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471734, < * | unaffected |
| rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132379, < * | unaffected |
| rhoai/odh-th06-cpu-torch210-py312-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-th06-cuda130-torch210-py312-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-th06-rocm64-torch291-py312-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-training-cuda128-torch29-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782991170, < * | unaffected |
| rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782133907, < * | unaffected |
| rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782472374, < * | unaffected |
| rhoai/odh-trustyai-nemo-guardrails-server-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782420349, < * | unaffected |
| rhoai/odh-vllm-cuda-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-vllm-gaudi-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-vllm-rocm-rhel9 | Red Hat / Red Hat OpenShift AI (RHOAI) | any version | unknown |
| rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782133865, < * | unaffected |
| rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471796, < * | unaffected |
| rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782133337, < * | unaffected |
| rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471661, < * | unaffected |
| rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132473, < * | unaffected |
| rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471753, < * | unaffected |
| rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471740, < * | unaffected |
| rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132660, < * | unaffected |
| rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471834, < * | unaffected |
| rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782301637, < * | unaffected |
| rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.3 | >= 1782471730, < * | unaffected |
| rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782132564, < * | unaffected |
| rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | Red Hat / Red Hat OpenShift AI 3.4 | >= 1782135300, < * | unaffected |
| satellite/foreman-mcp-server-rhel9 | Red Hat / Red Hat Satellite 6.18 | >= 1780492008, < * | unaffected |
| satellite/foreman-mcp-server-rhel9 | Red Hat / Red Hat Satellite 6.19 | >= 1780492012, < * | unaffected |
| satellite/iop-advisor-engine-rhel9 | Red Hat / Red Hat Satellite 6.17 | >= 1784834402, < * | unaffected |
| satellite/iop-host-inventory-rhel9 | Red Hat / Red Hat Satellite 6.19 | >= 1780403026, < * | unaffected |
| satellite/iop-host-inventory-rhel9 | Red Hat / Red Hat Satellite 6.18 | >= 1780414237, < * | unaffected |
| satellite/iop-vmaas-rhel9 | Red Hat / Red Hat Satellite 6.19 | >= 1782139619, < * | unaffected |
| satellite/iop-vulnerability-engine-rhel9 | Red Hat / Red Hat Satellite 6.18 | >= 1784554123, < * | unaffected |
| satellite/iop-vulnerability-engine-rhel9 | Red Hat / Red Hat Satellite 6.19 | >= 1788190224, < * | unaffected |
| starlette | Kludex / starlette | < 1.0.1 | affected |