bandit

Advisories 24

• CVE-2026-116078High 8.7

  HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

  Affected: from 0.3.1, fixed in 1.14.1; from 0.3.1, fixed in 1.14.1.

• CVE-2026-108529High 8.7

  SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

  Affected: from 0.3.4, fixed in 1.14.0.

• CVE-2026-110499High 8.7

  Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

  Affected: from 0.3.6, fixed in 1.14.0.

• CVE-2026-109584High 8.7

  HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

  Affected: from 0.3.3, fixed in 1.14.0.

• CVE-2026-111103High 8.2

  HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

  Affected: from 1.9.0, fixed in 1.14.0.

• CVE-2026-111101High 8.7

  HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

  Affected: from 0.1.0, fixed in 1.14.0.

• CVE-2026-113436High 8.7

  Quadratic bignum parsing of Content-Length and Host port values in Bandit

  Affected: from 1.0.0-pre.7, fixed in 1.14.0.

• CVE-2026-110314Medium 6.3

  WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

  Affected: from 0.5.1, fixed in 1.14.0.

• CVE-2026-114213High 8.7

  WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

  Affected: from 1.11.0, fixed in 1.14.0.

• CVE-2026-114216Medium 6.3

  Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

  Affected: from 1.12.4, fixed in 1.14.0.

• CVE-2026-115269High 8.7

  HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

  Affected: from 1.4.0, fixed in 1.14.0.

• CVE-2026-108525High 8.7

  HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

  Affected: from 0.3.1, fixed in 1.14.0.

• CVE-2026-105660Medium 6.9

  Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

  Affected: from 0.6.0, fixed in 1.13.0.

• CVE-2026-105659High 8.7

  HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

  Affected: from 1.4.0, fixed in 1.13.0.

• CVE-2026-75484Medium 6.9

  HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

  Affected: from 1.4.0, fixed in 1.12.5; from 1.4.0, fixed in 1.12.5.