Medium severity · published Feb 9, 2026
CVE-2026-25480
FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord() substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remote attacker can trigger cache key collisions via crafted paths, causing one URL to serve cached responses of another (cache poisoning/mixup). This vulnerability is fixed in 2.20.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
litestar · litestar-org
< 2.20.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25480
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25480
Release Notes
https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0
Patch
https://github.com/litestar-org/litestar/commit/85db6183a76f8a6b3fd6ee3c88d860b9f37a2cca
Release Notes
https://github.com/litestar-org/litestar/releases/tag/v2.20.0
Exploit
https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg
More from litestar
8.3
CVE-2024-42370
Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow
8.2
CVE-2024-32982
Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
8.1
CVE-2026-48060
Litestar: HTML Injection Through CSRF Token
7.5
CVE-2025-59152
X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting
7.5
CVE-2024-52581
Litestar allows unbounded resource consumption (DoS vulnerability)