Request Smuggling in the ASGI Stack: Starlette and LiteLLM

·7 views

Request Smuggling in the ASGI Stack: Starlette and LiteLLM Why framework-level parsing flaws travel far A web framework that parses requests incorrectly affects every application built on it, and the fix has to be applied in each of those deployments. Two 2026 CVEs make the point in the Python ecosystem. CVE-2026-48710 in the Kludex Starlette framework is described as HTTP request or response smuggling leading to authentication bypass, and CVE-2026-59822 in BerriAI LiteLLM is described as improper authentication. Both were added to CISA's Known Exploited Vulnerabilities catalog on 2 September

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DockForge — AI-Powered Dockerfile Generator

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend I built DockForge, an AI-powered Docker engineer that turns a software repository into a working Docker setup. I built it for a friend who often works on projects that run perfectly on their machine but become painful to containerize. Instead of manually figuring out the runtime, dependencies, package manager, ports, build commands, system packages, and startup configuration, DockForge analyzes the repository and generates a Docker setup tailored to the project. The goal isn't just to generate a Dockerfile that lo

0 comments Read more at DEV Community

ProgrammingDEV Community ·

J'ai publié 8 livres et guides sans dépenser un seul euro : le pipeline complet

Il y a trois semaines, je n'avais aucun produit en ligne. Aujourd'hui, huit guides sont en vente sur ma boutique, et une nouvelle sortie est prévue chaque lundi. Le plus intéressant n'est pas le contenu. C'est le pipeline. Chaque livre suit le même chemin : Un thème est choisi dans une liste (productivité, IA, freelance, organisation…) Le contenu est rédigé en markdown Un script Python convertit le markdown en EPUB compatible Amazon KDP Le même contenu devient un PDF propre pour la vente directe L'API de la boutique crée le produit, téléverse le fichier, met en vente La partie clé : les étapes

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to check if ChatGPT recommends your brand: a 30-minute manual audit

More and more people skip the search results page entirely. They open ChatGPT, Perplexity or Gemini, type a question like "what's the best invoicing tool for freelancers?", and pick one of the two or three names the answer gives them. Forget keywords for a moment. AI assistants receive full questions, often with context. Write 15 to 20 of them, split into three groups: Discovery questions: "what tools help with X?", "how do small teams handle Y?"- Comparison questions: "X vs Y", "alternatives to Z", "is X worth it?"- Problem questions: the pain your product solves, phrased the way a frustrated

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Mindset Shifts for Teams Adopting Elixir

How immutability, explicit data, pattern matching, and result values change software design. The first warning sign usually appears after the team is already productive. People know the syntax. They can build Phoenix controllers, write Ecto queries, use pipelines, and get features into production. And yet the code still feels wrong.

0 comments Read more at DEV Community