bandit
1.14.1
A pure-Elixir HTTP server built for Plug & WebSock apps
Current section
24 Advisories
Jump to
Current section
24 Advisories
HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-116078.html
- https://github.com/mtrudel/bandit/commit/327bb02ff84171237e1aeff787930debd16155ee
- https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f
- https://github.com/mtrudel/bandit/security/advisories/GHSA-pxjf-g536-7r93
- https://hex.pm/packages/bandit
SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-108529.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/6feadb31189d18b7dcda6c663112cd3bbaf63a46
- https://github.com/mtrudel/bandit/security/advisories/GHSA-j363-h72p-296m
- https://hex.pm/packages/bandit
Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-110499.html
- https://github.com/mtrudel/bandit/commit/0e68313fab9d204257ebad5c447e4cd9cea8e0ea
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/security/advisories/GHSA-47x4-3fxf-82fr
- https://hex.pm/packages/bandit
HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-109584.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/44bf969cd59851622fb6ee4d16227fbc39a77fb4
- https://github.com/mtrudel/bandit/security/advisories/GHSA-7gfj-7gvq-3xqj
- https://hex.pm/packages/bandit
HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-111103.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/3ad49c80c268891e7cc412e69649115456638e59
- https://github.com/mtrudel/bandit/security/advisories/GHSA-2238-pgfc-w82m
- https://hex.pm/packages/bandit
HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-111101.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/7201270c34b90f6c9e15c0386c2bb802c0c72ab4
- https://github.com/mtrudel/bandit/security/advisories/GHSA-jwh3-j29h-qfmw
- https://hex.pm/packages/bandit
Quadratic bignum parsing of Content-Length and Host port values in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-113436.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/e0c8c0c30af9b0f57d8aafac37ddd9294363a8be
- https://github.com/mtrudel/bandit/security/advisories/GHSA-29cr-8477-rg6r
- https://hex.pm/packages/bandit
WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-110314.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/bb407f2277dcb65a58dd8cc07913a0b58a80e266
- https://github.com/mtrudel/bandit/security/advisories/GHSA-2v5v-8f9v-xh85
- https://hex.pm/packages/bandit
WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-114213.html
- https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/security/advisories/GHSA-cpx7-qf6w-jc63
- https://hex.pm/packages/bandit
Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-114216.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/c31e9e3c76dcbfc239a96eabed5341ced7885ae5
- https://github.com/mtrudel/bandit/security/advisories/GHSA-w5wc-g2hc-g7m2
- https://hex.pm/packages/bandit
HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-115269.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f
- https://github.com/mtrudel/bandit/security/advisories/GHSA-p2qv-vx88-385x
- https://hex.pm/packages/bandit
HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-108525.html
- https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a
- https://github.com/mtrudel/bandit/commit/c8dc1e97050cf359f61ed6cdd110f3cdaf1d6f5f
- https://github.com/mtrudel/bandit/security/advisories/GHSA-c3g7-2pg5-qvwh
- https://hex.pm/packages/bandit
Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-105660.html
- https://github.com/mtrudel/bandit/commit/0e3edda0edf6322e9164b827c6d3ddecd080ff2e
- https://github.com/mtrudel/bandit/commit/6ea80210137b3f69caf65f67398934259dc365d0
- https://github.com/mtrudel/bandit/security/advisories/GHSA-v53v-9hvg-37jf
- https://hex.pm/packages/bandit
HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-105659.html
- https://github.com/mtrudel/bandit/commit/d88b21953c65061f21136ea76a89a4f95a2ac7a1
- https://github.com/mtrudel/bandit/commit/fff06efe3be962b484bd4d3eb339372fda5a231f
- https://github.com/mtrudel/bandit/security/advisories/GHSA-69m6-wcv4-rwcf
- https://hex.pm/packages/bandit
HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
Affected Versions
HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
Affected Versions
Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
Affected Versions
HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-39806.html
- https://github.com/mtrudel/bandit
- https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab
- https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf
- https://hex.pm/packages/bandit
- https://nvd.nist.gov/vuln/detail/CVE-2026-39806
- https://osv.dev/vulnerability/EEF-CVE-2026-39806
HTTP/1 chunked body reader ignores length cap in bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-39803.html
- https://github.com/mtrudel/bandit
- https://github.com/mtrudel/bandit/commit/ae3520dfdbfab115c638f8c7f6f6b805db34e1ab
- https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2
- https://hex.pm/packages/bandit
- https://nvd.nist.gov/vuln/detail/CVE-2026-39803
- https://osv.dev/vulnerability/EEF-CVE-2026-39803
HTTP/2 frame size limit checked after body is buffered in bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-42788.html
- https://github.com/mtrudel/bandit
- https://github.com/mtrudel/bandit/commit/1e8e55966da9129016b73d32f0e1df4630e3b463
- https://github.com/mtrudel/bandit/security/advisories/GHSA-q6v9-r226-v65f
- https://hex.pm/packages/bandit
- https://nvd.nist.gov/vuln/detail/CVE-2026-42788
- https://osv.dev/vulnerability/EEF-CVE-2026-42788
Client-supplied URI scheme trusted without transport verification in bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-39807.html
- https://github.com/mtrudel/bandit
- https://github.com/mtrudel/bandit/commit/45feea20dea8af7ffd7245271107b695c040e667
- https://github.com/mtrudel/bandit/security/advisories/GHSA-375f-4r2h-f99j
- https://hex.pm/packages/bandit
- https://nvd.nist.gov/vuln/detail/CVE-2026-39807
- https://osv.dev/vulnerability/EEF-CVE-2026-39807
CL.CL HTTP request smuggling via duplicate Content-Length in bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-39805.html
- https://github.com/mtrudel/bandit
- https://github.com/mtrudel/bandit/commit/f2ca636eb6df385219957e8934e9fc6efa1630d1
- https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7
- https://hex.pm/packages/bandit
- https://nvd.nist.gov/vuln/detail/CVE-2026-39805
- https://osv.dev/vulnerability/EEF-CVE-2026-39805
WebSocket fragmented message reassembly unbounded in bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-42786.html
- https://github.com/mtrudel/bandit
- https://github.com/mtrudel/bandit/commit/21612c7c7b1ce43eccd36d3af3a2299d23513667
- https://github.com/mtrudel/bandit/security/advisories/GHSA-pf94-94m9-536p
- https://hex.pm/packages/bandit
- https://nvd.nist.gov/vuln/detail/CVE-2026-42786
- https://osv.dev/vulnerability/EEF-CVE-2026-42786
WebSocket permessage-deflate inflate has no output-size cap in bandit
Affected Versions
References
- https://cna.erlef.org/cves/CVE-2026-39804.html
- https://github.com/mtrudel/bandit
- https://github.com/mtrudel/bandit/commit/8156921a51e684a951221da7bc30a70a022f722e
- https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j
- https://hex.pm/packages/bandit
- https://nvd.nist.gov/vuln/detail/CVE-2026-39804
- https://osv.dev/vulnerability/EEF-CVE-2026-39804
Checksum
Dependency Config
mix.exs
rebar.config
Gleam
erlang.mk
Package Details
this version
24 879
yesterday
95 087
last 7 days
498 766
all time
16 998 212
