https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:11:22.339239+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-25480 CVE-2026-25480 — FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD) 2026-10-06T17:11:22.381335+00:00

Affected: litestar-org litestar

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0.

 https://cve.radiocsirt.org/vuln/pysec-2026-2197 PYSEC-2026-2197 2026-10-06T17:11:22.381400+00:00

Affected: PyPI: litestar

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0.