CVE-2026-25480

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25480", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T16:31:35.821Z", "datePublished": "2026-02-09T18:49:34.305Z", "dateUpdated": "2026-02-10T16:01:06.327Z"}, "containers": {"cna": {"title": "FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)", "problemTypes": [{"descriptions": [{"cweId": "CWE-176", "lang": "en", "description": "CWE-176: Improper Handling of Unicode Encoding", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg"}, {"name": "https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca", "tags": ["x_refsource_MISC"], "url": "https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca"}, {"name": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0", "tags": ["x_refsource_MISC"], "url": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0"}, {"name": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0"}], "affected": [{"vendor": "litestar-org", "product": "litestar", "versions": [{"version": "< 2.20.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:49:34.305Z"}, "descriptions": [{"lang": "en", "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0."}], "source": {"advisory": "GHSA-vxqx-rh46-q2pg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:39:52.216141Z", "id": "CVE-2026-25480", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:01:06.327Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25480", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T15:39:52.216141Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:39:52.916Z"}}], "cna": {"title": "FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)", "source": {"advisory": "GHSA-vxqx-rh46-q2pg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "litestar-org", "product": "litestar", "versions": [{"status": "affected", "version": "< 2.20.0"}]}], "references": [{"url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg", "name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca", "name": "https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca", "tags": ["x_refsource_MISC"]}, {"url": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0", "name": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0", "name": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-176", "description": "CWE-176: Improper Handling of Unicode Encoding"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:49:34.305Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25480", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:01:06.327Z", "dateReserved": "2026-02-02T16:31:35.821Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-09T18:49:34.305Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "litestar", "vendor": "litestar-org", "versions": [{"status": "affected", "version": "< 2.20.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:litestar:litestar:*:*:*:*:*:*:*:*", "matchCriteriaId": "67E26161-0CDE-4B8F-A065-04A19BC4CDCB", "versionEndExcluding": "2.20.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0."}, {"lang": "es", "value": "Litestar es un framework de Interfaz de Pasarela de Servidor As\u00edncrono (ASGI). Antes de la versi\u00f3n 2.20.0, FileStore mapea las claves de cach\u00e9 a nombres de archivo utilizando la normalizaci\u00f3n Unicode NFKD y la sustituci\u00f3n ord() sin separadores, creando colisiones de claves. Cuando FileStore se utiliza como backend de cach\u00e9 de respuestas, un atacante remoto no autenticado puede desencadenar colisiones de claves de cach\u00e9 a trav\u00e9s de rutas manipuladas, haciendo que una URL sirva respuestas en cach\u00e9 de otra (envenenamiento/mezcla de cach\u00e9). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.20.0."}], "id": "CVE-2026-25480", "lastModified": "2026-06-17T10:24:42.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25480", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:39:52.216141Z", "version": "2.0.3"}}]}, "published": "2026-02-09T20:15:57.330", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-176"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.20.0)"}}], "product": "litestar", "vendor": "litestar-org"}], "analysis": {"en": {"generated_at": "2026-04-18T18:14:48.699475+00:00", "value": {"mitigation_remediation": ["Upgrade Litestar to version 2.20.0 or later", "Disable the FileStore response\u2011cache backend on all publicly exposed services until the upgrade can be applied", "Verify that cached responses are served from a backend that uses a deterministic key scheme and reconfigure or patch any custom caching logic that reproduces the colliding behaviour"], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure via Cache Poisoning"}, "threat_synthesis": {"affected_systems": "Litestar, an ASGI framework produced and maintained by litestar-org, is vulnerable in all releases prior to version 2.20.0. The problem is specific to deployments that use the FileStore as a response\u2011cache backend; if that feature is not enabled, the risk is mitigated.", "description_and_impact": "The vulnerability in Litestar arises from how its FileStore component creates cache keys. It normalizes request paths using Unicode NFKD and substitutes character code points via ord() without separating delimiters, which can produce identical keys for different URLs. An attacker who can send arbitrary HTTP requests to the server can craft paths that collide with legitimate cache keys, resulting in one URL serving the cached response of another. The effect is that sensitive data may be disclosed or the application may provide incorrect content, meeting CWE-176. The impact is not complete control over the system but can lead to information disclosure and functional disruption.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1\u202f%, implying a very low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, an unauthenticated attacker can reach the server over HTTP and send a crafted path to trigger the collision. The attack requires no special privileges, depends on the presence of the FileStore response\u2011cache backend, and leads directly to cache poisoning. While the likelihood of exploitation is low, the potential information disclosure is significant enough to warrant patching."}}}}, "created": "2026-02-10T16:26:52.802378+00:00", "updated": "2026-04-18T18:15:06.624379+00:00", "vendors": ["litestar-org", "litestar-org$PRODUCT$litestar"]}