Re:BadHost – CVE-2026-48710 Starlette Host-Header Auth Bypass
by ostif-derek on Thursday May 28, 2026 @11:13AM
(#48310126)
But you have to be super careful about defining the mitigations for this one, as for example Cloudflare passes malicious headers as-is without extra configuration, leaving hosts vulnerable when they are assumed to be protected.
[ Parent
| on HN ]
Re:BadHost – CVE-2026-48710 Starlette Host-Header Auth Bypass
by acdha on Thursday May 28, 2026 @12:30PM
(#48311322)
Yes. you always want to test any mitigation but Cloudflare and AWS ALBs both blocked non-DNS characters in host headers with no additional configuration when I tested it. It would be surprising if Cloudflare didn’t because the Host header is how they know which customer to route a request to.