CVE-2026-25480
📋 TL;DR
This vulnerability in Litestar's FileStore cache backend allows unauthenticated attackers to cause cache key collisions through specially crafted URLs. When exploited, it can make one URL serve cached responses from another URL, leading to cache poisoning or mixup. This affects all Litestar applications using FileStore as a response-cache backend prior to version 2.20.0.
💻 Affected Systems
- Litestar
📦 What is this software?
Litestar by Litestar
⚠️ Risk & Real-World Impact
Worst Case
Attackers could serve malicious cached content to users, potentially leading to data leakage, authentication bypass, or serving of harmful content.
Likely Case
Cache mixup causing incorrect data to be served to users, potentially exposing sensitive information or causing application errors.
If Mitigated
Limited impact if cache contains only non-sensitive data or if proper input validation and output encoding are implemented elsewhere.
🎯 Exploit Status
Exploitation requires knowledge of the cache key generation algorithm and ability to craft specific Unicode paths.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.20.0
Vendor Advisory: https://github.com/litestar-org/litestar/security/advisories/GHSA-vxqx-rh46-q2pg
Restart Required: Yes
Instructions:
1. Update Litestar to version 2.20.0 or later using pip: 'pip install --upgrade litestar>=2.20.0' 2. Restart your application server 3. Clear existing cache to remove potentially poisoned entries
🔧 Temporary Workarounds
Switch to alternative cache backend
allUse a different cache backend (e.g., Redis, Memcached) instead of FileStore
Modify your Litestar configuration to use a different cache backend
Disable response caching
allTemporarily disable response caching until patch can be applied
Set response caching to disabled in your Litestar configuration
🧯 If You Can't Patch
- Implement WAF rules to block suspicious Unicode path patterns
- Monitor cache access logs for unusual patterns of cache key collisions
🔍 How to Verify
Check if Vulnerable:
Check if using Litestar <2.20.0 with FileStore as response-cache backendCheck Version:
python -c "import litestar; print(litestar.__version__)"Verify Fix Applied:
Verify Litestar version is 2.20.0 or higher and test cache functionality📡 Detection & Monitoring
Log Indicators:
- Multiple cache hits for different URLs with same cache key
- Unusual Unicode patterns in URL paths
Network Indicators:
- Requests with specially crafted Unicode paths
- Cache headers showing incorrect cache keys
SIEM Query:
source="application_logs" AND ("cache key collision" OR "FileStore" AND "cache poisoning")