Fix to update Starlette vulnerability [HIGH] CVE-2026-48710 - Host Header Validation Bypass

[luis5tb]

As reported in CVE-2026-48710, Starlette has a HIGH severity vulnerability (Host Header Validation Bypass) in versions prior to 1.0.1.

The HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed.

The Issue

The current google-adk dependency constraints allow installing vulnerable versions of starlette.
google-adk restricts starlette to >=0.49.1,<1 (as seen in the pyproject.toml).

adk-python/pyproject.toml

Line 54 in aa51512

"starlette>=0.49.1,<1",

This constraint allows any starlette version from 0.49.1 up to (but not including) 1.0.0, all of which are vulnerable to CVE-2026-48710.
Consequently, there is no guarantee that users will have starlette >= 1.0.1 (which contains the fix that validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2) installed alongside google-adk.

Proposed Fix

Please update the starlette dependency constraint in pyproject.toml to require the patched version (e.g., >=1.0.1).
Note: The fastapi dependency (currently >=0.124.1,<1) may also need to be updated to a version that supports starlette >= 1.0.1.

google-adk
  └── starlette (>=0.49.1,<1)  <-- Allows vulnerable versions
  └── fastapi (>=0.124.1,<1)
       └── starlette (<1.0.1?)  <-- May also constrain to vulnerable versions

[IlonaShishov]

@llalitkumarrr @rohityan @boyangsvl Hello,
Could you please provide an estimate on when we can expect a release including this fix?
We are standing by to resolve this issue in our project as well, as it is dependent on the google-adk package.