# bandit (Hex) vulnerabilities 24 known vulnerabilities (17 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://hex.pm/packages/bandit ## Advisories (24) ### [CVE-2026-116078](https://cve.now/CVE-2026-116078): HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit - Severity: High 8.7 - Published: Oct 28, 2026 - Affected: from 0.3.1, fixed in 1.14.1; from 0.3.1, fixed in 1.14.1. ### [CVE-2026-108529](https://cve.now/CVE-2026-108529): SETTINGS and stream-0 WINDOW\_UPDATE frames trigger quadratic work over blocked streams in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 0.3.4, fixed in 1.14.0. ### [CVE-2026-110499](https://cve.now/CVE-2026-110499): Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 0.3.6, fixed in 1.14.0. ### [CVE-2026-109584](https://cve.now/CVE-2026-109584): HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 0.3.3, fixed in 1.14.0. ### [CVE-2026-111103](https://cve.now/CVE-2026-111103): HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit - Severity: High 8.2 - Published: Oct 26, 2026 - Affected: from 1.9.0, fixed in 1.14.0. ### [CVE-2026-111101](https://cve.now/CVE-2026-111101): HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 0.1.0, fixed in 1.14.0. ### [CVE-2026-113436](https://cve.now/CVE-2026-113436): Quadratic bignum parsing of Content-Length and Host port values in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 1.0.0-pre.7, fixed in 1.14.0. ### [CVE-2026-110314](https://cve.now/CVE-2026-110314): WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit - Severity: Medium 6.3 - Published: Oct 26, 2026 - Affected: from 0.5.1, fixed in 1.14.0. ### [CVE-2026-114213](https://cve.now/CVE-2026-114213): WebSocket 1-byte continuation frames bypass \`max\_fragmented\_message\_size\` in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 1.11.0, fixed in 1.14.0. ### [CVE-2026-114216](https://cve.now/CVE-2026-114216): Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit - Severity: Medium 6.3 - Published: Oct 26, 2026 - Affected: from 1.12.4, fixed in 1.14.0. ### [CVE-2026-115269](https://cve.now/CVE-2026-115269): HTTP/2 WINDOW\_UPDATE and SETTINGS frames reset the request body read timeout in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 1.4.0, fixed in 1.14.0. ### [CVE-2026-108525](https://cve.now/CVE-2026-108525): HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit - Severity: High 8.7 - Published: Oct 26, 2026 - Affected: from 0.3.1, fixed in 1.14.0. ### [CVE-2026-105660](https://cve.now/CVE-2026-105660): Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit - Severity: Medium 6.9 - Published: Oct 15, 2026 - Affected: from 0.6.0, fixed in 1.13.0. ### [CVE-2026-105659](https://cve.now/CVE-2026-105659): HTTP/2 blocked-send deadlines reset on every WINDOW\_UPDATE, letting a trickle pin stream processes indefinitely in Bandit - Severity: High 8.7 - Published: Oct 14, 2026 - Affected: from 1.4.0, fixed in 1.13.0. ### [CVE-2026-75484](https://cve.now/CVE-2026-75484): HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit - Severity: Medium 6.9 - Published: Aug 20, 2026 - Affected: from 1.4.0, fixed in 1.12.5; from 1.4.0, fixed in 1.12.5. ### [CVE-2026-74836](https://cve.now/CVE-2026-74836): HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit - Severity: High 8.7 - Published: Aug 20, 2026 - Affected: from 0.3.4, fixed in 1.12.5; from 0.3.4, fixed in 1.12.5. ### [CVE-2026-65623](https://cve.now/CVE-2026-65623): Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit - Severity: High 8.7 - Published: Jul 24, 2026 - Affected: from 1.11.0, fixed in 1.12.1; from 1.11.0, fixed in 1.12.1. ### [CVE-2026-39806](https://cve.now/CVE-2026-39806): HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit - Severity: High 8.7 - Published: May 13, 2026 - Affected: from 1.6.1, fixed in 1.11.1; from 1.6.1, fixed in 1.11.1; from 1.6.0, fixed in 1.11.1. ### [CVE-2026-39803](https://cve.now/CVE-2026-39803): HTTP/1 chunked body reader ignores length cap in bandit - Severity: High 8.7 - Published: May 13, 2026 - Affected: from 1.4.0, fixed in 1.11.1; from 1.4.0, fixed in 1.11.1. ### [CVE-2026-39805](https://cve.now/CVE-2026-39805): CL.CL HTTP request smuggling via duplicate Content-Length in bandit - Severity: Medium 6.3 - Published: May 1, 2026 - Affected: from 0.1.0, fixed in 1.11.0; from 0.1.0, fixed in 1.11.0; fixed in 1.11.0. ### [CVE-2026-39804](https://cve.now/CVE-2026-39804): WebSocket permessage-deflate inflate has no output-size cap in bandit - Severity: High 8.2 - Published: May 1, 2026 - Affected: from 0.5.9, fixed in 1.11.0; from 0.5.8, fixed in 1.11.0; from 0.5.9, fixed in 1.11.0. ### [CVE-2026-39807](https://cve.now/CVE-2026-39807): Client-supplied URI scheme trusted without transport verification in bandit - Severity: Medium 6.3 - Published: May 1, 2026 - Affected: from 1.0.0, fixed in 1.11.0; from 1.0.0, fixed in 1.11.0. ### [CVE-2026-42786](https://cve.now/CVE-2026-42786): WebSocket fragmented message reassembly unbounded in bandit - Severity: High 8.7 - Published: May 1, 2026 - Affected: from 0.5.0, fixed in 1.11.0; from 0.5.0, fixed in 1.11.0. ### [CVE-2026-42788](https://cve.now/CVE-2026-42788): HTTP/2 frame size limit checked after body is buffered in bandit - Severity: Medium 6.9 - Published: May 1, 2026 - Affected: from 0.3.6, fixed in 1.11.0; from 0.3.5, fixed in 1.11.0; from 0.3.6, fixed in 1.11.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/hex/bandit Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.