{"meta":{"links":{"Changelog":"https://bandit.hexdocs.pm/changelog.html","GitHub":"https://github.com/mtrudel/bandit"},"description":"A pure-Elixir HTTP server built for Plug & WebSock apps","licenses":["MIT"],"maintainers":[]},"name":"bandit","url":"https://hex.pm/api/packages/bandit","owners":[{"url":"https://hex.pm/api/users/chrismccord","email":"chris@chrismccord.com","username":"chrismccord"},{"url":"https://hex.pm/api/users/mtrudel","email":"mat@geeky.net","username":"mtrudel"}],"inserted_at":"2020-11-05T17:11:46.440731Z","updated_at":"2026-10-28T13:14:42.804406Z","repository":"hexpm","releases":[{"version":"1.14.1","url":"https://hex.pm/api/packages/bandit/releases/1.14.1","has_docs":true,"inserted_at":"2026-10-28T13:14:41.521051Z"},{"version":"1.14.0","url":"https://hex.pm/api/packages/bandit/releases/1.14.0","has_docs":true,"inserted_at":"2026-10-26T13:12:37.772438Z"},{"version":"1.13.1","url":"https://hex.pm/api/packages/bandit/releases/1.13.1","has_docs":true,"inserted_at":"2026-10-15T23:14:01.760084Z"},{"version":"1.13.0","url":"https://hex.pm/api/packages/bandit/releases/1.13.0","has_docs":true,"inserted_at":"2026-10-15T18:36:45.920138Z"},{"version":"1.12.5","url":"https://hex.pm/api/packages/bandit/releases/1.12.5","has_docs":true,"inserted_at":"2026-08-20T19:56:55.255909Z"},{"version":"1.12.4","url":"https://hex.pm/api/packages/bandit/releases/1.12.4","has_docs":true,"inserted_at":"2026-07-27T15:47:57.394513Z"},{"version":"1.12.3","url":"https://hex.pm/api/packages/bandit/releases/1.12.3","has_docs":true,"inserted_at":"2026-07-25T23:36:28.785276Z"},{"version":"1.12.2","url":"https://hex.pm/api/packages/bandit/releases/1.12.2","has_docs":true,"inserted_at":"2026-07-25T22:44:58.514740Z"},{"version":"1.12.1","url":"https://hex.pm/api/packages/bandit/releases/1.12.1","has_docs":true,"inserted_at":"2026-07-24T16:16:24.564696Z"},{"version":"1.12.0","url":"https://hex.pm/api/packages/bandit/releases/1.12.0","has_docs":true,"inserted_at":"2026-06-06T23:21:05.672746Z"},{"version":"1.11.1","url":"https://hex.pm/api/packages/bandit/releases/1.11.1","has_docs":true,"inserted_at":"2026-05-13T13:31:53.821884Z"},{"version":"1.11.0","url":"https://hex.pm/api/packages/bandit/releases/1.11.0","has_docs":true,"inserted_at":"2026-05-01T20:34:59.747115Z"},{"version":"1.10.4","url":"https://hex.pm/api/packages/bandit/releases/1.10.4","has_docs":true,"inserted_at":"2026-03-26T01:44:19.268760Z"},{"version":"1.10.3","url":"https://hex.pm/api/packages/bandit/releases/1.10.3","has_docs":true,"inserted_at":"2026-02-22T18:27:57.228856Z"},{"version":"1.10.2","url":"https://hex.pm/api/packages/bandit/releases/1.10.2","has_docs":true,"inserted_at":"2026-01-22T17:02:09.107837Z"},{"version":"1.10.1","url":"https://hex.pm/api/packages/bandit/releases/1.10.1","has_docs":true,"inserted_at":"2026-01-06T01:29:19.442181Z"},{"version":"1.10.0","url":"https://hex.pm/api/packages/bandit/releases/1.10.0","has_docs":true,"inserted_at":"2025-12-29T18:17:13.095565Z"},{"version":"1.9.0","url":"https://hex.pm/api/packages/bandit/releases/1.9.0","has_docs":true,"inserted_at":"2025-12-12T17:11:29.010415Z"},{"version":"1.8.0","url":"https://hex.pm/api/packages/bandit/releases/1.8.0","has_docs":true,"inserted_at":"2025-08-18T15:29:51.713763Z"},{"version":"1.7.0","url":"https://hex.pm/api/packages/bandit/releases/1.7.0","has_docs":true,"inserted_at":"2025-05-29T16:57:22.358745Z"},{"version":"1.6.11","url":"https://hex.pm/api/packages/bandit/releases/1.6.11","has_docs":true,"inserted_at":"2025-03-31T15:51:08.854619Z"},{"version":"1.6.10","url":"https://hex.pm/api/packages/bandit/releases/1.6.10","has_docs":true,"inserted_at":"2025-03-26T01:11:43.993187Z"},{"version":"1.6.9","url":"https://hex.pm/api/packages/bandit/releases/1.6.9","has_docs":true,"inserted_at":"2025-03-21T20:18:05.083918Z"},{"version":"1.6.8","url":"https://hex.pm/api/packages/bandit/releases/1.6.8","has_docs":true,"inserted_at":"2025-03-05T14:01:55.740667Z"},{"version":"1.6.7","url":"https://hex.pm/api/packages/bandit/releases/1.6.7","has_docs":true,"inserted_at":"2025-01-30T17:11:32.591723Z"},{"version":"1.6.6","url":"https://hex.pm/api/packages/bandit/releases/1.6.6","has_docs":true,"inserted_at":"2025-01-25T22:08:34.435551Z"},{"version":"1.6.5","url":"https://hex.pm/api/packages/bandit/releases/1.6.5","has_docs":true,"inserted_at":"2025-01-15T16:16:50.751700Z"},{"version":"1.6.4","url":"https://hex.pm/api/packages/bandit/releases/1.6.4","has_docs":true,"inserted_at":"2025-01-11T16:30:02.635723Z"},{"version":"1.6.3","url":"https://hex.pm/api/packages/bandit/releases/1.6.3","has_docs":true,"inserted_at":"2025-01-08T13:56:40.040352Z"},{"version":"1.6.2","url":"https://hex.pm/api/packages/bandit/releases/1.6.2","has_docs":true,"inserted_at":"2025-01-04T18:37:06.246534Z"},{"version":"1.6.1","url":"https://hex.pm/api/packages/bandit/releases/1.6.1","has_docs":true,"inserted_at":"2024-12-06T13:59:57.720551Z"},{"version":"1.6.0","url":"https://hex.pm/api/packages/bandit/releases/1.6.0","has_docs":true,"inserted_at":"2024-11-18T15:33:44.603017Z"},{"version":"1.5.7","url":"https://hex.pm/api/packages/bandit/releases/1.5.7","has_docs":true,"inserted_at":"2024-08-01T19:37:56.337400Z"},{"version":"1.5.6","url":"https://hex.pm/api/packages/bandit/releases/1.5.6","has_docs":true,"inserted_at":"2024-08-01T17:30:06.865987Z"},{"version":"1.5.5","url":"https://hex.pm/api/packages/bandit/releases/1.5.5","has_docs":true,"inserted_at":"2024-06-19T20:53:43.572814Z"},{"version":"1.5.4","url":"https://hex.pm/api/packages/bandit/releases/1.5.4","has_docs":true,"inserted_at":"2024-06-14T16:43:28.490094Z"},{"version":"1.5.3","url":"https://hex.pm/api/packages/bandit/releases/1.5.3","has_docs":true,"inserted_at":"2024-06-07T17:21:44.586421Z"},{"version":"1.5.2","url":"https://hex.pm/api/packages/bandit/releases/1.5.2","has_docs":true,"inserted_at":"2024-05-10T17:41:27.076573Z"},{"version":"1.5.1","url":"https://hex.pm/api/packages/bandit/releases/1.5.1","has_docs":true,"inserted_at":"2024-05-10T15:01:55.096936Z"},{"version":"1.5.0","url":"https://hex.pm/api/packages/bandit/releases/1.5.0","has_docs":true,"inserted_at":"2024-04-21T13:17:44.585884Z"},{"version":"1.4.2","url":"https://hex.pm/api/packages/bandit/releases/1.4.2","has_docs":true,"inserted_at":"2024-04-02T16:50:10.750143Z"},{"version":"1.4.1","url":"https://hex.pm/api/packages/bandit/releases/1.4.1","has_docs":true,"inserted_at":"2024-03-27T21:46:17.958865Z"},{"version":"1.4.0","url":"https://hex.pm/api/packages/bandit/releases/1.4.0","has_docs":true,"inserted_at":"2024-03-26T14:50:08.356150Z"},{"version":"1.3.0","url":"https://hex.pm/api/packages/bandit/releases/1.3.0","has_docs":true,"inserted_at":"2024-03-09T00:58:33.656860Z"},{"version":"1.2.3","url":"https://hex.pm/api/packages/bandit/releases/1.2.3","has_docs":true,"inserted_at":"2024-02-23T19:23:25.412606Z"},{"version":"1.2.2","url":"https://hex.pm/api/packages/bandit/releases/1.2.2","has_docs":true,"inserted_at":"2024-02-16T15:25:44.711792Z"},{"version":"1.2.1","url":"https://hex.pm/api/packages/bandit/releases/1.2.1","has_docs":true,"inserted_at":"2024-02-13T00:45:51.495879Z"},{"version":"1.2.0","url":"https://hex.pm/api/packages/bandit/releases/1.2.0","has_docs":true,"inserted_at":"2024-01-31T14:58:46.643271Z"},{"version":"1.1.3","url":"https://hex.pm/api/packages/bandit/releases/1.1.3","has_docs":true,"inserted_at":"2024-01-12T14:27:48.694648Z"},{"version":"1.1.2","url":"https://hex.pm/api/packages/bandit/releases/1.1.2","has_docs":true,"inserted_at":"2023-12-20T15:52:06.203622Z"},{"version":"1.1.1","url":"https://hex.pm/api/packages/bandit/releases/1.1.1","has_docs":true,"inserted_at":"2023-11-14T17:39:00.394909Z"},{"version":"1.1.0","url":"https://hex.pm/api/packages/bandit/releases/1.1.0","has_docs":true,"inserted_at":"2023-11-02T13:50:04.228390Z"},{"version":"1.0.0","url":"https://hex.pm/api/packages/bandit/releases/1.0.0","has_docs":true,"inserted_at":"2023-10-19T20:27:28.931145Z"},{"version":"1.0.0-pre.18","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.18","has_docs":true,"inserted_at":"2023-10-10T19:23:15.264197Z"},{"version":"1.0.0-pre.17","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.17","has_docs":true,"inserted_at":"2023-10-09T13:56:30.116026Z"},{"version":"1.0.0-pre.16","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.16","has_docs":true,"inserted_at":"2023-09-19T00:25:28.097456Z"},{"version":"1.0.0-pre.15","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.15","has_docs":true,"inserted_at":"2023-09-09T15:00:01.901165Z"},{"version":"1.0.0-pre.14","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.14","has_docs":true,"inserted_at":"2023-08-29T00:22:20.753092Z"},{"version":"1.0.0-pre.13","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.13","has_docs":true,"inserted_at":"2023-08-15T19:24:59.313162Z"},{"version":"1.0.0-pre.12","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.12","has_docs":true,"inserted_at":"2023-08-12T18:22:41.902294Z"},{"version":"1.0.0-pre.11","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.11","has_docs":true,"inserted_at":"2023-08-11T15:04:52.976057Z"},{"version":"1.0.0-pre.10","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.10","has_docs":true,"inserted_at":"2023-06-28T16:14:45.861013Z"},{"version":"1.0.0-pre.9","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.9","has_docs":true,"inserted_at":"2023-06-16T17:59:47.873636Z"},{"version":"1.0.0-pre.8","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.8","has_docs":true,"inserted_at":"2023-06-15T12:55:01.527032Z"},{"version":"1.0.0-pre.7","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.7","has_docs":true,"inserted_at":"2023-06-14T18:29:16.905957Z"},{"version":"1.0.0-pre.6","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.6","has_docs":true,"inserted_at":"2023-06-08T14:44:58.093339Z"},{"version":"1.0.0-pre.5","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.5","has_docs":true,"inserted_at":"2023-06-02T15:19:11.835521Z"},{"version":"1.0.0-pre.4","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.4","has_docs":true,"inserted_at":"2023-05-23T21:28:06.348371Z"},{"version":"1.0.0-pre.3","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.3","has_docs":true,"inserted_at":"2023-05-03T18:31:44.970981Z"},{"version":"1.0.0-pre.2","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.2","has_docs":true,"inserted_at":"2023-04-24T19:38:32.056131Z"},{"version":"1.0.0-pre.1","url":"https://hex.pm/api/packages/bandit/releases/1.0.0-pre.1","has_docs":true,"inserted_at":"2023-04-21T08:37:03.586981Z"},{"version":"0.7.7","url":"https://hex.pm/api/packages/bandit/releases/0.7.7","has_docs":true,"inserted_at":"2023-04-11T14:29:14.601994Z"},{"version":"0.7.6","url":"https://hex.pm/api/packages/bandit/releases/0.7.6","has_docs":true,"inserted_at":"2023-04-09T16:33:33.989152Z"},{"version":"0.7.5","url":"https://hex.pm/api/packages/bandit/releases/0.7.5","has_docs":true,"inserted_at":"2023-04-04T16:15:52.968015Z"},{"version":"0.7.4","url":"https://hex.pm/api/packages/bandit/releases/0.7.4","has_docs":true,"inserted_at":"2023-03-27T23:05:18.699155Z"},{"version":"0.7.3","url":"https://hex.pm/api/packages/bandit/releases/0.7.3","has_docs":true,"inserted_at":"2023-03-20T14:52:28.723438Z"},{"version":"0.7.2","url":"https://hex.pm/api/packages/bandit/releases/0.7.2","has_docs":true,"inserted_at":"2023-03-18T20:06:33.878276Z"},{"version":"0.7.1","url":"https://hex.pm/api/packages/bandit/releases/0.7.1","has_docs":true,"inserted_at":"2023-03-17T18:02:33.549485Z"},{"version":"0.7.0","url":"https://hex.pm/api/packages/bandit/releases/0.7.0","has_docs":true,"inserted_at":"2023-03-17T14:37:22.487725Z"},{"version":"0.6.11","url":"https://hex.pm/api/packages/bandit/releases/0.6.11","has_docs":true,"inserted_at":"2023-03-17T14:08:33.658663Z"},{"version":"0.6.10","url":"https://hex.pm/api/packages/bandit/releases/0.6.10","has_docs":true,"inserted_at":"2023-03-10T17:00:12.598420Z"},{"version":"0.6.9","url":"https://hex.pm/api/packages/bandit/releases/0.6.9","has_docs":true,"inserted_at":"2023-02-20T21:32:27.463202Z"},{"version":"0.6.8","url":"https://hex.pm/api/packages/bandit/releases/0.6.8","has_docs":true,"inserted_at":"2023-01-31T14:18:45.112715Z"},{"version":"0.6.7","url":"https://hex.pm/api/packages/bandit/releases/0.6.7","has_docs":true,"inserted_at":"2023-01-17T20:56:17.167150Z"},{"version":"0.6.6","url":"https://hex.pm/api/packages/bandit/releases/0.6.6","has_docs":true,"inserted_at":"2023-01-11T16:21:31.787587Z"},{"version":"0.6.5","url":"https://hex.pm/api/packages/bandit/releases/0.6.5","has_docs":true,"inserted_at":"2023-01-10T16:18:52.875828Z"},{"version":"0.6.4","url":"https://hex.pm/api/packages/bandit/releases/0.6.4","has_docs":true,"inserted_at":"2022-12-23T18:27:47.866402Z"},{"version":"0.6.3","url":"https://hex.pm/api/packages/bandit/releases/0.6.3","has_docs":true,"inserted_at":"2022-12-09T00:24:56.067698Z"},{"version":"0.6.2","url":"https://hex.pm/api/packages/bandit/releases/0.6.2","has_docs":true,"inserted_at":"2022-11-25T17:18:40.611629Z"},{"version":"0.6.1","url":"https://hex.pm/api/packages/bandit/releases/0.6.1","has_docs":true,"inserted_at":"2022-11-21T21:59:11.497673Z"},{"version":"0.6.0","url":"https://hex.pm/api/packages/bandit/releases/0.6.0","has_docs":true,"inserted_at":"2022-11-15T00:53:07.094951Z"},{"version":"0.5.11","url":"https://hex.pm/api/packages/bandit/releases/0.5.11","has_docs":true,"inserted_at":"2022-11-04T19:55:32.890109Z"},{"version":"0.5.10","url":"https://hex.pm/api/packages/bandit/releases/0.5.10","has_docs":true,"inserted_at":"2022-11-04T14:09:31.411608Z"},{"version":"0.5.9","url":"https://hex.pm/api/packages/bandit/releases/0.5.9","has_docs":true,"inserted_at":"2022-11-03T18:00:19.406143Z"},{"version":"0.5.8","url":"https://hex.pm/api/packages/bandit/releases/0.5.8","has_docs":true,"inserted_at":"2022-11-02T15:21:45.056239Z"},{"version":"0.5.7","url":"https://hex.pm/api/packages/bandit/releases/0.5.7","has_docs":true,"inserted_at":"2022-11-01T19:45:04.111997Z"},{"version":"0.5.6","url":"https://hex.pm/api/packages/bandit/releases/0.5.6","has_docs":true,"inserted_at":"2022-09-28T21:13:38.420675Z"},{"version":"0.5.5","url":"https://hex.pm/api/packages/bandit/releases/0.5.5","has_docs":true,"inserted_at":"2022-09-24T16:10:33.164062Z"},{"version":"0.5.4","url":"https://hex.pm/api/packages/bandit/releases/0.5.4","has_docs":true,"inserted_at":"2022-09-23T16:03:53.449977Z"},{"version":"0.5.3","url":"https://hex.pm/api/packages/bandit/releases/0.5.3","has_docs":true,"inserted_at":"2022-09-22T16:02:34.136941Z"},{"version":"0.5.2","url":"https://hex.pm/api/packages/bandit/releases/0.5.2","has_docs":true,"inserted_at":"2022-09-21T20:42:19.994564Z"},{"version":"0.5.1","url":"https://hex.pm/api/packages/bandit/releases/0.5.1","has_docs":true,"inserted_at":"2022-09-20T01:46:04.175894Z"},{"version":"0.5.0","url":"https://hex.pm/api/packages/bandit/releases/0.5.0","has_docs":true,"inserted_at":"2022-05-04T00:09:43.614486Z"},{"version":"0.4.10","url":"https://hex.pm/api/packages/bandit/releases/0.4.10","has_docs":true,"inserted_at":"2022-04-17T14:49:07.871367Z"},{"version":"0.4.9","url":"https://hex.pm/api/packages/bandit/releases/0.4.9","has_docs":true,"inserted_at":"2022-04-14T20:48:20.197992Z"},{"version":"0.4.8","url":"https://hex.pm/api/packages/bandit/releases/0.4.8","has_docs":true,"inserted_at":"2022-04-14T20:16:23.316247Z"},{"version":"0.4.7","url":"https://hex.pm/api/packages/bandit/releases/0.4.7","has_docs":true,"inserted_at":"2022-03-05T20:17:37.778672Z"},{"version":"0.4.6","url":"https://hex.pm/api/packages/bandit/releases/0.4.6","has_docs":true,"inserted_at":"2022-03-03T17:21:23.380014Z"},{"version":"0.4.5","url":"https://hex.pm/api/packages/bandit/releases/0.4.5","has_docs":true,"inserted_at":"2021-11-17T02:37:54.918828Z"},{"version":"0.4.4","url":"https://hex.pm/api/packages/bandit/releases/0.4.4","has_docs":true,"inserted_at":"2021-10-26T17:46:29.214001Z"},{"version":"0.4.3","url":"https://hex.pm/api/packages/bandit/releases/0.4.3","has_docs":true,"inserted_at":"2021-10-12T23:42:02.466639Z"},{"version":"0.4.2","url":"https://hex.pm/api/packages/bandit/releases/0.4.2","has_docs":true,"inserted_at":"2021-10-11T21:18:56.719041Z"},{"version":"0.4.1","url":"https://hex.pm/api/packages/bandit/releases/0.4.1","has_docs":true,"inserted_at":"2021-09-27T19:13:33.511825Z"},{"version":"0.4.0","url":"https://hex.pm/api/packages/bandit/releases/0.4.0","has_docs":true,"inserted_at":"2021-09-27T15:48:13.283160Z"},{"version":"0.3.9","url":"https://hex.pm/api/packages/bandit/releases/0.3.9","has_docs":true,"inserted_at":"2021-09-25T21:55:21.299049Z"},{"version":"0.3.8","url":"https://hex.pm/api/packages/bandit/releases/0.3.8","has_docs":true,"inserted_at":"2021-09-25T00:53:32.250262Z"},{"version":"0.3.7","url":"https://hex.pm/api/packages/bandit/releases/0.3.7","has_docs":true,"inserted_at":"2021-09-24T13:12:55.283287Z"},{"version":"0.3.6","url":"https://hex.pm/api/packages/bandit/releases/0.3.6","has_docs":true,"inserted_at":"2021-09-18T18:10:01.980993Z"},{"version":"0.3.5","url":"https://hex.pm/api/packages/bandit/releases/0.3.5","has_docs":true,"inserted_at":"2021-09-15T21:07:19.389937Z"},{"version":"0.3.4","url":"https://hex.pm/api/packages/bandit/releases/0.3.4","has_docs":true,"inserted_at":"2021-09-13T15:06:08.008443Z"},{"version":"0.3.3","url":"https://hex.pm/api/packages/bandit/releases/0.3.3","has_docs":true,"inserted_at":"2021-06-29T22:01:52.119376Z"},{"version":"0.3.2","url":"https://hex.pm/api/packages/bandit/releases/0.3.2","has_docs":true,"inserted_at":"2021-06-24T21:26:10.961510Z"},{"version":"0.2.3","url":"https://hex.pm/api/packages/bandit/releases/0.2.3","has_docs":true,"inserted_at":"2021-05-09T20:44:31.640559Z"},{"version":"0.2.2","url":"https://hex.pm/api/packages/bandit/releases/0.2.2","has_docs":true,"inserted_at":"2021-04-30T13:23:07.132504Z"},{"version":"0.2.1","url":"https://hex.pm/api/packages/bandit/releases/0.2.1","has_docs":true,"inserted_at":"2021-04-29T19:41:34.544061Z"},{"version":"0.2.0","url":"https://hex.pm/api/packages/bandit/releases/0.2.0","has_docs":true,"inserted_at":"2021-04-26T01:14:40.670680Z"},{"version":"0.1.1","url":"https://hex.pm/api/packages/bandit/releases/0.1.1","has_docs":true,"inserted_at":"2020-11-08T15:48:28.740682Z"},{"version":"0.1.0","url":"https://hex.pm/api/packages/bandit/releases/0.1.0","has_docs":true,"inserted_at":"2020-11-05T17:11:46.452942Z"}],"html_url":"https://hex.pm/packages/bandit","latest_version":"1.14.1","downloads":{"all":18035197,"day":78303,"recent":4755374,"week":503142},"security_advisories":[{"id":"EEF-CVE-2026-116078","aliases":["CVE-2026-116078","GHSA-pxjf-g536-7r93"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-pxjf-g536-7r93"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-116078.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/327bb02ff84171237e1aeff787930debd16155ee"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-116078","published_at":"2026-10-28T13:26:25Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-116078","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-28T13:41:02Z","withdrawn_at":null,"affected":[">= 0.3.1 and < 1.14.1"]},{"id":"EEF-CVE-2026-108529","aliases":["CVE-2026-108529","GHSA-j363-h72p-296m"],"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-108529.html"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-j363-h72p-296m"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/6feadb31189d18b7dcda6c663112cd3bbaf63a46"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-108529","published_at":"2026-10-26T13:35:26Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-108529","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 0.3.4 and < 1.14.0"]},{"id":"EEF-CVE-2026-110499","aliases":["CVE-2026-110499","GHSA-47x4-3fxf-82fr"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-110499.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-110499","published_at":"2026-10-26T13:32:38Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-110499","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 0.3.6 and < 1.14.0"]},{"id":"EEF-CVE-2026-109584","aliases":["CVE-2026-109584","GHSA-7gfj-7gvq-3xqj"],"references":[{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-109584.html"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-109584","published_at":"2026-10-26T13:32:22Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-109584","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:07Z","withdrawn_at":null,"affected":[">= 0.3.3 and < 1.14.0"]},{"id":"EEF-CVE-2026-111103","aliases":["CVE-2026-111103","GHSA-2238-pgfc-w82m"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-2238-pgfc-w82m"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/3ad49c80c268891e7cc412e69649115456638e59"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-111103.html"}],"summary":"HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-111103","published_at":"2026-10-26T13:32:06Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-111103","cvss_score":8.2,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 1.9.0 and < 1.14.0"]},{"id":"EEF-CVE-2026-111101","aliases":["CVE-2026-111101","GHSA-jwh3-j29h-qfmw"],"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-111101.html"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/7201270c34b90f6c9e15c0386c2bb802c0c72ab4"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-jwh3-j29h-qfmw"}],"summary":"HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-111101","published_at":"2026-10-26T13:31:48Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-111101","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 0.1.0 and < 1.14.0"]},{"id":"EEF-CVE-2026-113436","aliases":["CVE-2026-113436","GHSA-29cr-8477-rg6r"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-113436.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"Quadratic bignum parsing of Content-Length and Host port values in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-113436","published_at":"2026-10-26T13:31:35Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-113436","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 1.0.0-pre.7 and < 1.14.0"]},{"id":"EEF-CVE-2026-110314","aliases":["CVE-2026-110314","GHSA-2v5v-8f9v-xh85"],"references":[{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-2v5v-8f9v-xh85"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-110314.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/bb407f2277dcb65a58dd8cc07913a0b58a80e266"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"}],"summary":"WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-110314","published_at":"2026-10-26T13:31:18Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-110314","cvss_score":6.3,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 0.5.1 and < 1.14.0"]},{"id":"EEF-CVE-2026-114213","aliases":["CVE-2026-114213","GHSA-cpx7-qf6w-jc63"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-cpx7-qf6w-jc63"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-114213.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-114213","published_at":"2026-10-26T13:30:58Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-114213","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 1.11.0 and < 1.14.0"]},{"id":"EEF-CVE-2026-114216","aliases":["CVE-2026-114216","GHSA-w5wc-g2hc-g7m2"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-w5wc-g2hc-g7m2"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-114216.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/c31e9e3c76dcbfc239a96eabed5341ced7885ae5"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-114216","published_at":"2026-10-26T13:30:41Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-114216","cvss_score":6.3,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","modified_at":"2026-10-26T13:56:06Z","withdrawn_at":null,"affected":[">= 1.12.4 and < 1.14.0"]},{"id":"EEF-CVE-2026-115269","aliases":["CVE-2026-115269","GHSA-p2qv-vx88-385x"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-p2qv-vx88-385x"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-115269.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-115269","published_at":"2026-10-26T13:30:24Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-115269","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:56:07Z","withdrawn_at":null,"affected":[">= 1.4.0 and < 1.14.0"]},{"id":"EEF-CVE-2026-108525","aliases":["CVE-2026-108525","GHSA-c3g7-2pg5-qvwh"],"references":[{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-108525.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-108525","published_at":"2026-10-26T13:29:42Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-108525","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-26T13:41:07Z","withdrawn_at":null,"affected":[">= 0.3.1 and < 1.14.0"]},{"id":"EEF-CVE-2026-105660","aliases":["CVE-2026-105660","GHSA-v53v-9hvg-37jf"],"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-105660.html"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/6ea80210137b3f69caf65f67398934259dc365d0"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/0e3edda0edf6322e9164b827c6d3ddecd080ff2e"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-v53v-9hvg-37jf"}],"summary":"Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-105660","published_at":"2026-10-15T18:37:02Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-105660","cvss_score":6.9,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","modified_at":"2026-10-15T18:56:05Z","withdrawn_at":null,"affected":[">= 0.6.0 and < 1.13.0"]},{"id":"EEF-CVE-2026-105659","aliases":["CVE-2026-105659","GHSA-69m6-wcv4-rwcf"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/d88b21953c65061f21136ea76a89a4f95a2ac7a1"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-105659.html"}],"summary":"HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-105659","published_at":"2026-10-14T16:54:46Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-105659","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-10-15T18:45:03Z","withdrawn_at":null,"affected":[">= 1.4.0 and < 1.13.0"]},{"id":"EEF-CVE-2026-75484","aliases":["CVE-2026-75484","GHSA-x3gh-xhj4-3vq8"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-x3gh-xhj4-3vq8"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-75484.html"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/d38cf046c9a3cae4d0f88001c2ceb4143f86366b"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-75484","published_at":"2026-08-20T21:11:27Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-75484","cvss_score":6.9,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","modified_at":"2026-09-09T00:30:03Z","withdrawn_at":null,"affected":[">= 1.4.0 and < 1.12.5"]},{"id":"EEF-CVE-2026-74836","aliases":["CVE-2026-74836","GHSA-xj8g-532w-jv94"],"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-74836.html"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/f6914aad14bb1365dd6f306aa592cfb0819bed3e"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-xj8g-532w-jv94"}],"summary":"HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-74836","published_at":"2026-08-20T21:11:18Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-74836","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-09-09T00:30:03Z","withdrawn_at":null,"affected":[">= 0.3.4 and < 1.12.5"]},{"id":"EEF-CVE-2026-65623","aliases":["CVE-2026-65623","GHSA-vg8x-66vg-5pxh"],"references":[{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/418ef7e906192a230ddba112f7a669c87b6b0e3a"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-65623.html"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-vg8x-66vg-5pxh"}],"summary":"Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-65623","published_at":"2026-07-24T16:32:24Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-65623","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-09-08T03:30:07Z","withdrawn_at":null,"affected":[">= 1.11.0 and < 1.12.1"]},{"id":"GHSA-rf5q-vwxw-gmrf","aliases":["CVE-2026-39806","EEF-CVE-2026-39806"],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39806"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39806.html"},{"type":"PACKAGE","url":"https://github.com/mtrudel/bandit"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-39806"}],"summary":"Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder","api_url":"https://api.osv.dev/v1/vulns/GHSA-rf5q-vwxw-gmrf","published_at":"2026-05-19T19:25:21Z","html_url":"https://osv.dev/vulnerability/GHSA-rf5q-vwxw-gmrf","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-06-08T20:31:01Z","withdrawn_at":null,"affected":[">= 1.6.0 and < 1.11.1"]},{"id":"GHSA-9q9q-324x-93r2","aliases":["CVE-2026-39803","EEF-CVE-2026-39803"],"references":[{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-39803"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39803"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39803.html"},{"type":"PACKAGE","url":"https://github.com/mtrudel/bandit"}],"summary":"Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked`","api_url":"https://api.osv.dev/v1/vulns/GHSA-9q9q-324x-93r2","published_at":"2026-05-19T19:23:49Z","html_url":"https://osv.dev/vulnerability/GHSA-9q9q-324x-93r2","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-06-08T20:31:01Z","withdrawn_at":null,"affected":[">= 1.4.0 and < 1.11.1"]},{"id":"EEF-CVE-2026-39806","aliases":["CVE-2026-39806","GHSA-rf5q-vwxw-gmrf"],"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39806.html"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab"}],"summary":"HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-39806","published_at":"2026-05-13T13:36:17Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-39806","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-07-30T18:21:59Z","withdrawn_at":null,"affected":[">= 1.6.1 and < 1.11.1"]},{"id":"EEF-CVE-2026-39803","aliases":["CVE-2026-39803","GHSA-9q9q-324x-93r2"],"references":[{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39803.html"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"}],"summary":"HTTP/1 chunked body reader ignores length cap in bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-39803","published_at":"2026-05-13T13:36:09Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-39803","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-07-30T18:22:11Z","withdrawn_at":null,"affected":[">= 1.4.0 and < 1.11.1"]},{"id":"GHSA-q6v9-r226-v65f","aliases":["CVE-2026-42788","EEF-CVE-2026-42788"],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42788"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-q6v9-r226-v65f"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-42788.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/1e8e55966da9129016b73d32f0e1df4630e3b463"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-42788"},{"type":"PACKAGE","url":"https://github.com/mtrudel/bandit"}],"summary":"Bandit HTTP/2 Frame Size Limit Bypass via Late Buffer Check Enables Memory Exhaustion","api_url":"https://api.osv.dev/v1/vulns/GHSA-q6v9-r226-v65f","published_at":"2026-05-07T03:52:31Z","html_url":"https://osv.dev/vulnerability/GHSA-q6v9-r226-v65f","cvss_score":6.9,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","modified_at":"2026-05-07T04:03:19Z","withdrawn_at":null,"affected":[">= 0.3.5 and < 1.11.0"]},{"id":"GHSA-375f-4r2h-f99j","aliases":["CVE-2026-39807","EEF-CVE-2026-39807"],"references":[{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-39807"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-375f-4r2h-f99j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39807"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/45feea20dea8af7ffd7245271107b695c040e667"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39807.html"},{"type":"PACKAGE","url":"https://github.com/mtrudel/bandit"}],"summary":"Bandit trusts client-supplied URI scheme on plaintext connections","api_url":"https://api.osv.dev/v1/vulns/GHSA-375f-4r2h-f99j","published_at":"2026-05-07T03:47:29Z","html_url":"https://osv.dev/vulnerability/GHSA-375f-4r2h-f99j","cvss_score":6.3,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","modified_at":"2026-05-07T04:04:48Z","withdrawn_at":null,"affected":[">= 1.0.0 and < 1.11.0"]},{"id":"GHSA-c67r-gc9j-2qf7","aliases":["CVE-2026-39805","EEF-CVE-2026-39805"],"references":[{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-39805"},{"type":"PACKAGE","url":"https://github.com/mtrudel/bandit"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39805.html"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/f2ca636eb6df385219957e8934e9fc6efa1630d1"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39805"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7"}],"summary":"Bandit is vulnerable to CL.CL request smuggling via unrejected duplicate `Content-Length` header","api_url":"https://api.osv.dev/v1/vulns/GHSA-c67r-gc9j-2qf7","published_at":"2026-05-07T03:46:31Z","html_url":"https://osv.dev/vulnerability/GHSA-c67r-gc9j-2qf7","cvss_score":6.3,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","modified_at":"2026-05-07T04:02:04Z","withdrawn_at":null,"affected":["< 1.11.0"]},{"id":"GHSA-pf94-94m9-536p","aliases":["CVE-2026-42786","EEF-CVE-2026-42786"],"references":[{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667"},{"type":"PACKAGE","url":"https://github.com/mtrudel/bandit"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-pf94-94m9-536p"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-42786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42786"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-42786.html"}],"summary":"Bandit Buffers Unbounded WebSocket Continuation Frames, Allowing Unauthenticated Memory Exhaustion","api_url":"https://api.osv.dev/v1/vulns/GHSA-pf94-94m9-536p","published_at":"2026-05-07T03:43:45Z","html_url":"https://osv.dev/vulnerability/GHSA-pf94-94m9-536p","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-05-07T04:03:36Z","withdrawn_at":null,"affected":[">= 0.5.0 and < 1.11.0"]},{"id":"GHSA-frh3-6pv6-rc8j","aliases":["CVE-2026-39804","EEF-CVE-2026-39804"],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39804"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39804.html"},{"type":"PACKAGE","url":"https://github.com/mtrudel/bandit"},{"type":"WEB","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-39804"}],"summary":"Bandit's unbounded WebSocket inflate causes BEAM OOM with a single frame","api_url":"https://api.osv.dev/v1/vulns/GHSA-frh3-6pv6-rc8j","published_at":"2026-05-07T03:36:13Z","html_url":"https://osv.dev/vulnerability/GHSA-frh3-6pv6-rc8j","cvss_score":8.2,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-05-07T03:47:36Z","withdrawn_at":null,"affected":[">= 0.5.8 and < 1.11.0"]},{"id":"EEF-CVE-2026-39805","aliases":["CVE-2026-39805","GHSA-c67r-gc9j-2qf7"],"references":[{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39805.html"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/f2ca636eb6df385219957e8934e9fc6efa1630d1"}],"summary":"CL.CL HTTP request smuggling via duplicate Content-Length in bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-39805","published_at":"2026-05-01T20:34:29Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-39805","cvss_score":6.3,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","modified_at":"2026-07-30T18:21:59Z","withdrawn_at":null,"affected":[">= 0.1.0 and < 1.11.0"]},{"id":"EEF-CVE-2026-39804","aliases":["CVE-2026-39804","GHSA-frh3-6pv6-rc8j"],"references":[{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39804.html"}],"summary":"WebSocket permessage-deflate inflate has no output-size cap in bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-39804","published_at":"2026-05-01T20:34:24Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-39804","cvss_score":8.2,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-09-08T03:45:03Z","withdrawn_at":null,"affected":[">= 0.5.9 and < 1.11.0"]},{"id":"EEF-CVE-2026-39807","aliases":["CVE-2026-39807","GHSA-375f-4r2h-f99j"],"references":[{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/45feea20dea8af7ffd7245271107b695c040e667"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-375f-4r2h-f99j"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-39807.html"}],"summary":"Client-supplied URI scheme trusted without transport verification in bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-39807","published_at":"2026-05-01T20:34:22Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-39807","cvss_score":6.3,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","modified_at":"2026-09-08T03:45:04Z","withdrawn_at":null,"affected":[">= 1.0.0 and < 1.11.0"]},{"id":"EEF-CVE-2026-42786","aliases":["CVE-2026-42786","GHSA-pf94-94m9-536p"],"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-42786.html"},{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-pf94-94m9-536p"}],"summary":"WebSocket fragmented message reassembly unbounded in bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-42786","published_at":"2026-05-01T20:34:17Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-42786","cvss_score":8.7,"cvss_rating":"high","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","modified_at":"2026-09-08T03:45:04Z","withdrawn_at":null,"affected":[">= 0.5.0 and < 1.11.0"]},{"id":"EEF-CVE-2026-42788","aliases":["CVE-2026-42788","GHSA-q6v9-r226-v65f"],"references":[{"type":"PACKAGE","url":"https://hex.pm/packages/bandit"},{"type":"ADVISORY","url":"https://github.com/mtrudel/bandit/security/advisories/GHSA-q6v9-r226-v65f"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-42788.html"},{"type":"FIX","url":"https://github.com/mtrudel/bandit/commit/1e8e55966da9129016b73d32f0e1df4630e3b463"}],"summary":"HTTP/2 frame size limit checked after body is buffered in bandit","api_url":"https://api.osv.dev/v1/vulns/EEF-CVE-2026-42788","published_at":"2026-05-01T20:34:11Z","html_url":"https://osv.dev/vulnerability/EEF-CVE-2026-42788","cvss_score":6.9,"cvss_rating":"medium","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","modified_at":"2026-07-30T18:22:10Z","withdrawn_at":null,"affected":[">= 0.3.6 and < 1.11.0"]}],"docs_html_url":"https://bandit.hexdocs.pm/","retirements":{"1.10.0":{"message":"Improper DEFLATE implementation","reason":"other"}},"configs":{"erlang.mk":"dep_bandit = hex 1.14.1","mix.exs":"{:bandit, \"~> 1.14\"}","rebar.config":"{bandit, \"1.14.1\"}"},"latest_stable_version":"1.14.1"}